owasp-amass/amass · error

failed to extract the FQDN asset

Error message

failed to extract the FQDN asset

What it means

The known-FQDN plugin's check() asserts e.Entity.Asset to *oamdns.FQDN to evaluate scope and known-ness of domain names. A failed assertion means the event is not an FQDN asset; the plugin returns this error, failing the event. It is an asset-type routing problem, not a data problem.

Source

Thrown at engine/plugins/known_fqdn.go:63

		Transforms:   []string{string(oam.FQDN)},
		EventType:    oam.FQDN,
		Callback:     d.check,
	}); err != nil {
		return err
	}

	d.log.Info("Plugin started")
	return nil
}

func (d *knownFQDN) Stop() {
	d.log.Info("Plugin stopped")
}

func (d *knownFQDN) check(e *et.Event) error {
	fqdn, ok := e.Entity.Asset.(*oamdns.FQDN)
	if !ok {
		return errors.New("failed to extract the FQDN asset")
	}

	if a, conf := e.Session.Scope().IsAssetInScope(fqdn, 0); conf == 0 || a == nil {
		return nil
	} else if f, ok := a.(*oamdns.FQDN); !ok || f == nil || !strings.EqualFold(fqdn.Name, f.Name) {
		return nil
	}

	support.AddSLDInScope(e)
	d.process(e, d.lookup(e, e.Entity))
	return nil
}

func (d *knownFQDN) lookup(e *et.Event, dom *dbt.Entity) []*dbt.Entity {
	ctx, cancel := context.WithTimeout(e.Session.Ctx(), 60*time.Second)
	defer cancel()

	names, _ := db.FindByFQDNScope(ctx, e.Session.DB(), dom, time.Time{})

View on GitHub (pinned to 79299dce87)

Solutions

1. Return nil when the cast fails so non-FQDN events are ignored silently
2. Restrict the plugin's event subscription to FQDN assets
3. Ensure upstream FQDN events use *oamdns.FQDN exactly

Example fix

// before
fqdn, ok := e.Entity.Asset.(*oamdns.FQDN)
if !ok {
	return errors.New("failed to extract the FQDN asset")
}

// after
fqdn, ok := e.Entity.Asset.(*oamdns.FQDN)
if !ok {
	return nil
}

if _, ok := e.Entity.Asset.(*oamdns.FQDN); !ok {
	return nil
}

func asFQDN(e *et.Event) (*oamdns.FQDN, bool) {
	f, ok := e.Entity.Asset.(*oamdns.FQDN)
	return f, ok
}

if err := d.check(ev); err != nil {
	if strings.Contains(err.Error(), "failed to extract the FQDN") {
		continue // non-FQDN event
	}
	log.Error(err)
}

When it happens

Trigger: Events with assets other than *oamdns.FQDN (e.g. IP, netblock, or certificate assets) invoke knownFQDN.check.

Common situations: Broad event subscriptions; new asset types added upstream that match the topic; using custom FQDN types instead of oamdns.FQDN.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

• failed to extract the FQDN asset
• failed to extract the FQDN asset
• failed to extract the FQDN asset
• failed to extract the FQDN asset
• failed to extract the FQDN asset

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/5283a6debf6e9a5d. Report an issue: GitHub.