otlite · Domain and DNS
Install dnstwist on Linux or macOS in one command
dnstwist generates lookalike domains for a name you give it, including typos, homoglyphs, and extra TLDs, then checks which ones are registered and what they resolve to. Output includes MX records, so you see which lookalikes can receive mail.
dnstwist in three lines
pipx install otlite
otlite install dnstwist
otlite run dnstwist -- d:example.comRuns elceef/dnstwist (Apache-2.0, ★ 5.7k, otlite 1.2.1, catalog updated Oct 23, 2026). otlite installs and runs it at a tested version; it does not change or verify the tool itself.
What dnstwist is for
- Brand and phishing monitoring for your own domain.
- Checking a suspicious domain for the brand it imitates.
- Scheduled diffs with otlite diff to catch newly registered lookalikes.
Typed inputs for dnstwist
otlite translates these prefixes into dnstwist's own flags. Anything else after -- is passed through unchanged, so every original flag still works.
- d:
- Domain ·
otlite run dnstwist -- d:example.com
Run every installed tool that takes the same input at once: otlite run --all d:example.com
Where the results go
Every run lands under ./results/dnstwist/<target>/ as a timestamped output file, a .meta.json sidecar (the exact command, start and end time, exit code, and the SHA-256 of the output), and a .envelope.json with the entities found, in the same shape for every tool. List runs with otlite results, group them with --case, compare the last two with otlite diff dnstwist <target>, and pull indicators out with otlite extract dnstwist.
Before you run it
- Resolution is live DNS traffic from your machine. Use --registered to keep the output short.
Update, remove, inspect
otlite info dnstwist # inputs, keys, an example command
otlite example dnstwist # sample output, where there is one
otlite update dnstwist # move to the next tested version
otlite remove dnstwist # delete its virtualenvFull reference: the otlite docs, and the tool's own README on GitHub.
Pairs with
When open-source isn't enough
dnstwist finds the lookalike. SearchIn's WHOIS and DNS-history providers tell you who registered it and when it last changed.
FAQ
dnstwist with otlite, answered
How do I install dnstwist on Kali, Ubuntu, or macOS?
Install otlite once with pipx install otlite (or the one-line installer on the otlite page), run otlite init, then otlite install dnstwist. The tool lands in its own virtualenv under ~/.otlite/, pinned to a version that was tested, so nothing touches your system Python. otlite doctor prints the command that fixes a missing git or venv module.
Which inputs does dnstwist take through otlite?
d: (domain). otlite maps each prefix to dnstwist's own flag. Everything after -- that is not a typed input is passed through unchanged, so the original flags still work.
Where does otlite save dnstwist results?
Under ./results/dnstwist/<target>/ in the folder you run from, as a timestamped output file plus a .meta.json sidecar (the exact command, timing, exit code, and SHA-256) and a .envelope.json with the entities found. Add --case <name> to group runs, otlite results to list them, and otlite diff dnstwist <target> to compare the last two.
Does dnstwist need an API key or a login?
No key is required for the basic run. Optional keys, where the project supports them, go in with otlite keys set NAME and are passed only to tools that declare them.
Can I run dnstwist together with other tools?
Yes. otlite run --all d:example.com runs every installed tool that takes domain input, in parallel, including dnstwist. Save the combination as a playbook to repeat it.