owasp-amass/amass · error

failed to traverse the aliases

Error message

failed to traverse the aliases

What it means

cnameQuery exhausted its loop over the CNAME alias chain without reaching an address record: every dns_record edge examined was either not a BasicDNSRelation, not an A/AAAA (RRType 1/28) or CNAME (RRType 5) record, or the chain ended without a resolvable target. The sentinel fires when getAddr was never reachable through the alias traversal.

Source

Thrown at internal/net/addr.go:160

			break
		}
		set.Insert(n.Asset.Key())

		if edges, err := db.OutgoingEdges(ctx, n, since, "dns_record"); err == nil && len(edges) > 0 {
			for _, edge := range edges {
				if rel, ok := edge.Relation.(*oamdns.BasicDNSRelation); ok {
					if rel.Header.RRType == 1 || rel.Header.RRType == 28 {
						return getAddr(ctx, db, edge.ToEntity, since)
					} else if rel.Header.RRType == 5 {
						next = edge.ToEntity
						continue loop
					}
				}
			}
		}
	}

	return nil, errors.New("failed to traverse the aliases")
}

View on GitHub (pinned to 79299dce87)

Solutions

1. Verify the CNAME chain in the graph terminates in A/AAAA records within the 'since' window
2. Guard against CNAME loops or chains that exceed the traversal's implicit limits
3. Treat the error as 'unresolvable alias' in NamesToAddrs and skip the name instead of propagating the failure

When it happens

Trigger: Thrown at internal/net/addr.go:160 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/ae11849059e16067. Report an issue: GitHub.