Does dnsX automatically filter out all dead domains from a list?

[T145]

I'm using dnsX to check sources from old lists, and have results as follows:

Input: https://github.com/HexxiumCreations/threat-list/blob/gh-pages/domainsonly
Result: https://github.com/T145/san-junipero/blob/master/exports/hexxium/dnsx.json

I'd expect the resulting list to have 2,978 entries with dead sources giving a "NXDOMAIN" status code. Are hosts returning "NXDOMAIN" still alive? Are all the completely dead hosts filtered out automatically?

From "Running dnsX" I'm guessing dead hosts are filtered, but just want to double-check.

[ehsandeep]

@T145 Yes, not sure what cmd you used to run dnsx, but on default run it filters dead record, but optionally you can include other type of response as well if using rcode flag.

Here is the output for the same input https://temp.sh/EUjhf/filtered.json that only contains valid DNS entries only.

dnsx -l domainsonly -json -o filtered.json

[T145]

My command is similar to this:

cat domainsonly | dnsx -r ./configs/resolvers.txt -json -silent -rcode $(seq -s, 0 23) -retry 2

Does this not print only valid DNS entries?

[ehsandeep]

-rcode 0 is same as NOERRO status code, i.e valid DNS entries, but as you are pulling all DNS status code, so the result includes invalid once as well.

update the cmd to include only -rcode 0 if you are looking to pull valid entries only. @T145

[T145]

I think my confusion was between switching the context in either "active" and "valid." Only active hosts are printed, and host DNS validity is filtered by the response code.

Thanks for the help!