otinstaller · Domain and DNS

Install dnstwist on Linux in one command

dnstwist generates lookalike domains for a name you give it, including typos, homoglyphs, and extra TLDs, then checks which ones are registered and what they resolve to. Output includes MX records, so you see which lookalikes can receive mail.

dnstwist in three lines

pipx install otinstaller
ot install dnstwist
ot run dnstwist -- d:example.com

Runs elceef/dnstwist (Apache-2.0, ★ 5.7k, otinstaller v0.0.4, registry updated Oct 13, 2026). otinstaller installs and runs it; it does not change or verify it.

What dnstwist is for

Brand and phishing monitoring for your own domain.
Checking a suspicious domain for the brand it imitates.
Scheduled diffs with ot diff to catch newly registered lookalikes.

Typed inputs for dnstwist

otinstaller translates these prefixes into dnstwist's own flags. Anything else after -- is passed through unchanged, so every original flag still works.

d:: domain · ot run dnstwist -- d:example.com

It also takes ip input through its own flags; there is no typed prefix for those yet.

Run every installed tool that takes the same input at once: ot run --all d:example.com

Where the results go

Every run lands under ./results/dnstwist/<target>/ as a timestamped output file plus a .meta.json sidecar: the exact command, start and end time, exit code, and the SHA-256 of the output. Group runs with --case, compare the last two with ot diff dnstwist <target>, and pull indicators out with ot extract.

Before you run it

Resolution is live DNS traffic from your machine. Use --registered to keep the output short.

Update, remove, inspect

ot info dnstwist      # inputs, flags, keys
ot example dnstwist   # sample output
ot update dnstwist    # move to the next tested version
ot remove dnstwist    # delete its virtualenv

Full reference for this tool: docs for dnstwist.

Pairs with

dnsgen

dnsgen takes a list of known subdomains and generates plausible permutations: numbers, environments, regions, and common words.

ctfr

ctfr lists the subdomains of a domain by reading Certificate Transparency logs through crt.sh.

Fierce

Fierce brute-forces subdomains with a wordlist, tries zone transfers, and scans the IP space around the hosts it finds for more names.

When open-source isn't enough

dnstwist finds the lookalike. SearchIn's WHOIS and DNS-history providers tell you who registered it and when it last changed.

Domain intelligence

Domain intelligence

Domain intelligence

FAQ

dnstwist with otinstaller, answered

How do I install dnstwist on Kali or Ubuntu?

Install otinstaller once with pipx install otinstaller, run ot init, then ot install dnstwist. The tool lands in its own virtualenv under ~/.otinstaller/, pinned to a version that was tested on Ubuntu, so nothing touches your system Python. ot doctor flags a missing git or venv module.

Which inputs does dnstwist take through otinstaller?

d: (domain). otinstaller maps each prefix to dnstwist's own flag. Everything after -- that is not a typed input is passed through unchanged, so the original flags still work.

Where does otinstaller save dnstwist results?

Under ./results/dnstwist/<target>/ in the folder you run from, as a timestamped output file plus a .meta.json sidecar with the exact command, timing, exit code, and SHA-256. Add --case <name> to group runs, and ot diff dnstwist <target> to compare the last two.

Does dnstwist need an API key or a login?

No key is required for the basic run. Optional keys, where the project supports them, go in ~/.otinstaller/.env and are passed only to tools that declare them.

Can I run dnstwist together with other tools?

Yes. ot run --all d:example.com runs every installed tool that accepts domain input, in parallel, including dnstwist. Save the combination as a playbook to repeat it.