active enumeration cannot be performed without DNS resolutio

Error message

active enumeration cannot be performed without DNS resolution

What it means

CheckSettings rejects a configuration where both Passive and Active modes are enabled. Passive mode means no DNS resolution is performed, so active enumeration (which requires DNS queries) cannot coexist with it.

Source

Thrown at config/config.go:242

	}
}

// UpdateConfig allows the provided Updater to update the current configuration.
func (c *Config) UpdateConfig(update Updater) error {
	return update.OverrideConfig(c)
}

// CheckSettings runs some sanity checks on the configuration options selected.
func (c *Config) CheckSettings() error {
	var err error

	if c.BruteForcing {
		if c.Passive {
			return errors.New("brute forcing cannot be performed without DNS resolution")
		}
	}
	if c.Passive && c.Active {
		return errors.New("active enumeration cannot be performed without DNS resolution")
	}

	c.Wordlist, err = ExpandMaskWordlist(c.Wordlist)
	if err != nil {
		return err
	}

	c.AltWordlist, err = ExpandMaskWordlist(c.AltWordlist)
	if err != nil {
		return err
	}
	return err
}

// LoadSettings parses settings from an .yaml file and assigns them to the Config.
func (c *Config) LoadSettings(path string) error {
	// Determine and store the absolute path of the config file
	absolutePath, err := filepath.Abs(path)

View on GitHub (pinned to 79299dce87)

Solutions

Set Active: false to run purely passively, or Passive: false to allow active enumeration.
Fix CLI flag parsing so the modes are mutually exclusive (passive implies active off).
Check the loaded config file for both 'active' and 'passive' keys set to true.
Pre-validate flags at startup and print a clear usage message.

Example fix

// before
cfg.Passive = true
cfg.Active = true
// after
cfg.Passive = true
cfg.Active = false

Defensive patterns

Strategy: validation

Validate before calling

if passive && active {
    return errors.New("passive and active modes are mutually exclusive")
}

Try / catch

if err := cfg.CheckSettings(); err != nil {
    if strings.Contains(err.Error(), "active enumeration cannot be performed") {
        // set Active=false or Passive=false and rebuild the config
    }
    return err
}

Prevention

Enforce mutual exclusivity of mode flags at the CLI layer.
Use a single mode enum rather than two booleans.
Document the semantics of passive vs active in docs/help.
Add unit tests covering all flag combinations.

When it happens

Trigger: Calling Config.CheckSettings() when c.Passive == true && c.Active == true, e.g. a config file or flag combination that enables both enumeration modes.

Common situations: Merging a passive-mode config with an active-mode default, or passing flags like '-p' together with '-a' so both booleans end up true.

Understand the failure class

DNS resolution errors: ENOTFOUND and getaddrinfo failures — how hostname lookups fail and how to debug them.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/d25941c3c68333ab. Report an issue: GitHub.