brute forcing cannot be performed without DNS resolution

Error message

brute forcing cannot be performed without DNS resolution

What it means

CheckSettings rejects a configuration where brute forcing is enabled while Passive mode is on. Brute forcing requires actively sending DNS queries, which is impossible when the library is restricted to passive/no-DNS-resolution mode, so this combination is treated as a configuration contradiction.

Source

Thrown at config/config.go:238

			TTL:        1440,
			Confidence: 50,
			Priority:   5,
		},
	}
}

// UpdateConfig allows the provided Updater to update the current configuration.
func (c *Config) UpdateConfig(update Updater) error {
	return update.OverrideConfig(c)
}

// CheckSettings runs some sanity checks on the configuration options selected.
func (c *Config) CheckSettings() error {
	var err error

	if c.BruteForcing {
		if c.Passive {
			return errors.New("brute forcing cannot be performed without DNS resolution")
		}
	}
	if c.Passive && c.Active {
		return errors.New("active enumeration cannot be performed without DNS resolution")
	}

	c.Wordlist, err = ExpandMaskWordlist(c.Wordlist)
	if err != nil {
		return err
	}

	c.AltWordlist, err = ExpandMaskWordlist(c.AltWordlist)
	if err != nil {
		return err
	}
	return err
}

View on GitHub (pinned to 79299dce87)

Solutions

Disable passive mode if brute forcing is required (set Passive: false).
Disable brute forcing / remove wordlist options when running in passive mode.
Update the CLI flag combination before constructing the Config.
Validate flag combinations in the CLI layer with an early error message.

Example fix

// before
cfg.BruteForcing = true
cfg.Passive = true
// after
cfg.Passive = false // brute forcing requires active DNS resolution

Defensive patterns

Strategy: validation

Validate before calling

if bruteForcing && passive {
    return errors.New("passive mode cannot be combined with brute forcing")
}

Try / catch

if err := cfg.CheckSettings(); err != nil {
    if strings.Contains(err.Error(), "brute forcing cannot be performed") {
        // disable brute forcing or turn off passive mode and retry
    }
    return err
}

Prevention

Make passive and brute-force flags mutually exclusive in CLI parsing.
Document flag conflicts in help text.
Add a preflight check before constructing Config.
Use an enum mode (passive|active|hybrid) instead of independent booleans.

When it happens

Trigger: Calling Config.CheckSettings() when c.BruteForcing == true and c.Passive == true, typically after flags like -p (passive) were combined with brute-forcing options or wordlists.

Common situations: A developer enables passive mode to stay undetectable but leaves brute forcing (or a wordlist) enabled in the config file, or combines CLI flags such as '--passive' with '--wordlist'.

Understand the failure class

DNS resolution errors: ENOTFOUND and getaddrinfo failures — how hostname lookups fail and how to debug them.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/96d864421547a1da. Report an issue: GitHub.