subenum brute-forces subdomains from a wordlist, then tells you how much of the answer to trust. Each lookup is counted as resolved, NXDOMAIN, timeout or refused, and every run ends with a verdict a script can check.
go install github.com/TMHSDigital/subenum@latestdocker pull ghcr.io/tmhsdigital/subenum:latestStatic builds for Linux, macOS, Windows and FreeBSD. Download the latest release.
Scan only domains you own or have written permission to test.
When resolvers time out, a wordlist scan doesn't fail loudly. It returns fewer names and looks finished. subenum keeps a ledger of every lookup and grades the run, so you know whether “not found” means not there or not asked.
The verdict and its reason land in -stats run.json and on the last line of -format jsonl. One jq call turns it into a pipeline gate.
jq -e '.verdict == "complete"' run.json12 of 5000 lookups failed (timeout 9, refused 3, other 0), under 1%
71 of 5000 lookups failed (timeout 64, refused 7, other 0)
the reliability guard aborted the scan: 412 of 1800 lookups failed (timeout 398, refused 14, other 0)
Each of these is a flag or a field you can check for yourself, not a promise in a README.
Spread queries across many resolvers. Failing ones are benched, every hit is re-checked against your trusted resolver before it's printed, and canary checks catch a resolver that hides names that exist.
-r resolvers.txt -dns-server 9.9.9.9
subenum fingerprints wildcard answers before the scan and learns CDN pools that rotate. An inconclusive check is reported as inconclusive, never as “no wildcard”.
"wildcard": true, "wildcard_filtered": 112
-rate caps packets on the wire, counting retries and every record type, so the number in your rules of engagement is the number you send.
-rate 200 "achieved_qps": 198.6
Excluded names are never queried, not filtered afterwards. Exact names and *.parent patterns, inline or from a file.
-exclude '*.corp.example.com'
CNAMEs that dangle or point at takeover-prone services such as S3, GitHub Pages, Heroku and Azure are flagged for you to verify by hand.
TAKEOVER?=dangling:heroku
Compare against the last run and print only names that appeared or disappeared. Exit code 4 means something changed.
-diff previous.jsonl
Send queries over plain DNS, DNS over TLS or DNS over HTTPS by changing one address.
-dns-server tls://1.1.1.1
No runtime, no services, no API keys. A 5,000-entry wordlist is built in, so subenum yourdomain.com works out of the box.
go install github.com/TMHSDigital/subenum@latest
Resolved names go to stdout, one per line, so they pipe cleanly. Progress and the per-outcome breakdown go to stderr.
subenum example.com
subenum -w big-wordlist.txt -type A,AAAA,CNAME -show-records example.comA thorough scan over a resolver pool at a fixed rate, with results and the run report written atomically. The job fails unless every lookup was accounted for.
subenum -w big-wordlist.txt -r resolvers.txt -rate 500 -type A,AAAA,CNAME \
-format jsonl -o results.jsonl -stats run.json example.com
jq -e '.verdict == "complete"' run.jsonRun on a schedule and get told only about what changed. The guide includes a ready-made GitHub Actions workflow that opens an issue.
subenum -w wordlist.txt -format jsonl -diff previous.jsonl -o current.jsonl example.com
echo $? # 4 when names were added or removedAnswer every query from a scenario file instead of the network: wildcards, rate limits and failing resolvers, reproducibly, with zero packets sent.
subenum -w examples/labs/words.txt \
-simulate-zone examples/labs/lab2-wildcard.zone lab.exampleEmbed the same engine in your own tool. Every zero value takes the CLI default, and Run streams results as they arrive.
results, stats, err := subenum.Scan(ctx, subenum.Config{
Domain: "example.com",
Rate: 100,
Types: []string{"A", "AAAA", "CNAME"},
})subfinder covers passive sources. puredns, shuffledns and dnsx are built for raw mass resolution. subenum is the active brute-force step for when you need to defend the result: a single binary that shows its working.
It also teaches. -simulate gives marked, reproducible output with no network traffic, and -tui puts every option in a form.
subenum -tuigo install github.com/TMHSDigital/subenum@latest && subenum -simulate example.com