gonsec

DNSSEC NSEC/NSEC3 walking tool in Go.

gonsec discovers a delegation point for a domain, identifies whether the zone uses NSEC or NSEC3, then tries to enumerate labels and fetch RR data.

Requirements

• Go 1.25+

Install

Repository: https://codeberg.org/pawal/gonsec

Install the latest tagged release directly from Codeberg with the Go module path:

go install codeberg.org/pawal/gonsec/cmd/gonsec@latest

Install a specific release tag:

go install codeberg.org/pawal/gonsec/cmd/gonsec@v1.0.0

The binary is installed to $(go env GOBIN) if set, otherwise $(go env GOPATH)/bin.

Build

go build -o gonsec ./cmd/gonsec

Quick Start

./gonsec --domain example.com

Print version:

./gonsec --version

By default:

• output is CSV on stdout (--text=true)
• mode is auto-detect (--mode auto)
• timeout is 2s, retries 2, max runtime 30s
• IPv6 transport is disabled (use --ipv6 to enable)
• by default CSV is emitted after the run completes; with --progress, rows stream as discovered.

Common Usage

Enable IPv6 transport:

./gonsec --domain example.com --ipv6

Write JSON to stdout (CSV is suppressed in JSON mode):

./gonsec --domain example.com --json

Write NDJSON to stdout:

./gonsec --domain example.com --ndjson

Show debug warnings:

./gonsec --domain example.com --verbose 2

Show live progress while scanning (spinner on stderr, CSV rows streamed on stdout):

./gonsec --domain example.com --builtin-wordlist common --progress

Stream NDJSON name items as they are discovered (meta is written at the end):

./gonsec --domain example.com --ndjson --progress

Use embedded built-in wordlists (shipped in the binary):

./gonsec --domain example.com --builtin-wordlist common

common probes the common-small seed labels first (for example www) to improve useful coverage within default runtime limits.

Use the smaller built-in wordlist (faster, lower coverage):

./gonsec --domain example.com --builtin-wordlist common-small

List available built-in wordlists:

./gonsec --list-builtin-wordlists

Use a local file wordlist (still supported):

./gonsec --domain example.com --wordlist wordlists/nsec3-common-labels.txt

Use explicit resolvers only (no system/local resolver fallback):

./gonsec --domain example.com --resolver 1.1.1.1:53 --resolver 8.8.8.8:53

Use the built-in iterative resolver (no external resolver dependency):

./gonsec --domain example.com --internal-resolver

Output

Default CSV columns:

fqdn,rr_type,rdata,ttl,class,source,confidence,zone,domain,dnssec_mode

Notes:

• unresolved NSEC3 hashes are tracked in stats.unresolved_hashes (not emitted as rows/items).
• wordlist probing detects wildcard templates (for example *.zone) and filters likely wildcard-synthesized labels.

Detailed output schema and RR type mapping:

• docs/output.md

Key Flags

Required:

• --domain target domain.

General:

• --version print CLI version and exit.

Output:

• --text, --json, --ndjson.

Mode and runtime:

• --mode auto|nsec|nsec3.
• --timeout, --retries, --max-runtime, --max-queries, --parallel, --verbose, --progress.
• --max-runtime is a hard cap for the entire run (discovery + walk + recovery + probing). Large wordlists may not be fully exhausted within this budget.

Resolver and transport:

• --resolver repeatable resolver override (host[:port]); when set, system resolvers are not used.
• --internal-resolver uses gonsec's built-in iterative resolver for discovery (mutually exclusive with --resolver).
• --ipv6, --no-ipv6, --no-ipv4.

Wordlists and NSEC3 recovery:

• --wordlist for file-based labels.
• --builtin-wordlist for embedded labels.
• --list-builtin-wordlists to print embedded lists and exit.
• --bruteforce-max-len, --bruteforce-charset, --max-bruteforce-candidates, --mutations.

Caveats

• NSEC3 cleartext recovery is best-effort, not guaranteed.
• Some authoritative servers rate-limit/drop high probe rates; use --verbose 2 to inspect warnings.
• Tool output quality is network and authority behavior dependent.

Development

Run tests:

go test ./...

Build:

make build

The module imports codeberg.org/miekg/dns directly.

Legal and Ethical Use

Use only on domains/zones you are authorized to test. DNS enumeration and recovery activity may violate policy or law without permission.