Arsenly
Tools
Recon & Discovery16 tools Web Security Audit10 tools Exploitation & OOB3 tools Payloads & Wordlists4 tools Cryptography & Generators3 tools Encoders & Converters5 tools Reference & Reports4 tools
Browse the full catalogue Open /explore →
Free Tools
Recon & Discovery
SiteMapper ProTurn a URL list into 4 views: hierarchical host/path tree, sortable fl… URL & Endpoint ExtractorMine URLs, JS endpoints, domains and parameters from pasted source cod… CIDR / IP CalculatorIPv4 and IPv6 subnet math. Expand CIDRs, parse ranges and netmasks, ag…
Web Security Audit
Cookie / JWT AuditorAudit cookie flags (Secure, HttpOnly, SameSite, __Host- / __Secure- pr… OpenAPI / Swagger AnalyzerPaste or drop an OpenAPI 3 / Swagger 2 spec and map its attack surface…
Cryptography & Generators
Hash ToolkitGenerate (MD5, NTLM, SHA) and identify 60+ hash types with ranked cand… Test Data GeneratorRealistic-looking test data across 22 countries: names, emails, phone … Code / Password / Token GeneratorCustom-charset strings (1-512 chars, up to 5000 at a time), passwords …
Encoders & Converters
Encoder / Decoder4-tab workbench: 20+ encodings (URL, double-URL, percent-all, Base64, … HTTP Request ConverterConvert HTTP requests between 6 formats: Raw HTTP (Burp), curl, fetch(… JSON WorkbenchFormat, validate (with line / col error), minify, sort keys, unescape … Text Suite7-tab text workbench: regex find/replace, sort/dedupe/sample, keep-dro… Text Comparer4-tab diff workbench: true LCS line / word / char diff, side-by-side, …
See all 13 free tools on /explore →
Pricing
Resources
ChangelogWhat's shipped lately API DocsAutomate scans from your CLI About XowiaLabsWho's behind this ContactBug reports, ideas, just say hi Terms & PrivacyAcceptable-use policy + privacy
Sign in Get started
← All tools

CNAME / DNS Checker

Recon & Discovery

Resolve every core DNS record, follow the CNAME chain, and flag subdomain-takeover candidates - in one lookup.

What is CNAME / DNS Checker?

CNAME / DNS Checker gives you a fast, structured view of a hostname’s DNS - addresses, the full CNAME chain, mail routing, name servers, CAA and text records - without juggling dig commands. Everything is DNS-only, so it never touches the target and is safe to run anywhere.

For bug bounty it does the high-value bits up front: it follows CNAMEs to their final target and tells you when that target is an unclaimed third-party service (a subdomain-takeover lead), detects wildcard DNS, and reads your email-spoofing posture.

What it does

  • Full records - A, AAAA, CNAME, MX, NS, TXT, CAA and SOA together.
  • CNAME chain - follows aliases to the final target (where takeovers live).
  • Takeover fingerprinting - flags CNAMEs pointing at S3, GitHub Pages, Heroku, Azure, Netlify and more.
  • Reverse DNS (PTR) - resolves each A record back to its hostname.
  • Mail posture - SPF presence and the enforced DMARC policy.
  • Wildcard detection - warns when any subdomain resolves (false-positive risk for brute forcing).
  • Provider ID - names the DNS and email providers from NS/MX.

Where it fits in your workflow

  • →Confirm where a host points and whether its CNAME is a takeover candidate.
  • →Read email-spoofing protection (SPF/DMARC) at a glance.
  • →Pivot straight into the Takeover Scanner, Subdomain Discovery or DNS Recon Pro.
Use CNAME / DNS Checker

Run it from your dashboard.

Create free account Sign in Use via API

At a glance

CategoryRecon & Discovery
RunsServer-side
Token cost 2 / run (free tier)
Access Free
Status● Live

Frequently asked questions

How is this different from DNS Recon Pro?

This is the quick single-host view with takeover/SPF/DMARC/wildcard signals. DNS Recon Pro goes deeper - AXFR zone-transfer testing, full SPF/DMARC/DKIM scoring and DNSSEC validation.

A CNAME was flagged as a takeover candidate - is it vulnerable?

Not necessarily. It means the alias points to a third-party service; whether it’s takeover-able depends on the resource being unclaimed. Confirm with the Takeover Scanner.

Explore more tools →