Skip to content

Network Configuration

Jump to bottom
Serg edited this page Jun 6, 2026 · 6 revisions

Network Configuration

This page explains the network-related settings used by ReconSR modules that perform DNS resolution, HTTP API calls, certificate transparency lookups, WHOIS/RDAP requests, and other external network operations.

ReconSR stores these settings in configs/network.txt under the [Options], [DoH], and [Plain] sections. These values control timeouts, retry behavior, resolver selection, API pagination, and optional network-heavy enrichment features.

On first startup, ReconSR creates the default network configuration automatically only when configs/network.txt is not found. If the file already exists, ReconSR uses the existing file and does not overwrite it with defaults.

Warning

Change the default network settings with caution. Timeouts, retry counts, concurrency, pagination, and subdomain scanning options can significantly affect scan duration, third-party API usage, and paid-service costs. Before increasing limits, confirm the consequences for your environment and review the current limits of each provider plan.

Default values match the generated configs/network.txt file. Free API tiers and paid subscriptions can have different request rates, page limits, and quotas. If your subscription permits broader usage, you can raise the related values, but do so deliberately and monitor quota consumption.

Configuration File Creation

ReconSR checks for the network configuration file during startup:

  1. If configs/network.txt exists, ReconSR loads the existing settings.
  2. If configs/network.txt is missing, ReconSR creates a default file.
  3. After the file is created, users can edit it manually to adjust network behavior.

This behavior protects existing custom settings from being replaced by default values.

Configuration Layout

The network configuration file is located at:

configs/network.txt

It is divided into three main sections:

[Options]
# Module-specific timeout, retry, pagination, and feature flags

[DoH]
# DNS-over-HTTPS resolvers

[Plain]
# Plain DNS resolvers
  • [Options] controls module behavior and network execution limits.
  • [DoH] lists DNS-over-HTTPS resolvers used for encrypted DNS queries.
  • [Plain] lists traditional DNS resolvers used for fallback and direct DNS operations.

General Network and Retry Options

These settings apply broadly across modules that open network connections or retry failed requests.

Option Default Description
Timeout 10 General timeout, in seconds, for network dial operations.
KeepAlive 30 TCP keep-alive interval, in seconds, for persistent connections.
RetryBaseDelay 2 Base pause, in seconds, between HTTP retry attempts across modules.

Retry delays use exponential backoff. The configured base delay is used as the initial pause, and each subsequent retry waits longer than the previous retry.

Example:

[Options]
Timeout=10
KeepAlive=30
RetryBaseDelay=2

DNS Options

DNS settings control how ReconSR resolves records and performs DNS-heavy discovery tasks.

Option Default Description
DNSQueryTimeout 10 Timeout, in seconds, for simple DNS-over-HTTPS queries such as LOC, SSHFP, and DNSKEY.
DNSFallbackTimeout 15 Timeout, in seconds, for queries that use DNS-over-HTTPS with plain DNS fallback, such as NS, MX, and TXT.
DNSBruteTimeout 40 Timeout, in seconds, for concurrent brute-force DNS operations such as DKIM, SRV, and TLSA.
DNSConcurrency 10 Maximum number of parallel goroutines used by brute-force DNS handlers.
MaxRetriesDNS 3 Maximum retry attempts for DNS resolution.

Example:

[Options]
DNSQueryTimeout=10
DNSFallbackTimeout=15
DNSBruteTimeout=40
DNSConcurrency=10
MaxRetriesDNS=3

DNS Resolver Lists

ReconSR supports both DNS-over-HTTPS and plain DNS resolvers. The default resolver lists are selected from non-filtering DNS providers to reduce the risk of missing records because of DNS-level blocking or content filtering.

ReconSR does not rely on the operating system's local DNS resolver for these module lookups. Instead, it uses the resolvers listed in [DoH] and [Plain] and rotates them, so each subsequent DNS request is sent to the next configured resolver.

DNS-over-HTTPS Resolvers

The [DoH] section defines DNS-over-HTTPS endpoints used for DoH-capable lookups.

Warning

Change DoH resolvers with caution. ReconSR expects DoH endpoints that can return compatible JSON responses. Not every public DoH server supports the same request format or response format, and incompatible endpoints can cause incomplete or failed DNS results.

[DoH]
https://dns.cloudflare.com/dns-query
https://dns.google/resolve
https://unfiltered.adguard-dns.com/resolve
https://mozilla.cloudflare-dns.com/dns-query
https://doh.dns.sb/dns-query

Plain DNS Resolvers

The [Plain] section defines traditional DNS resolvers. These are used for fallback and plain DNS operations.

[Plain]
1.1.1.1
8.8.8.8
9.9.9.10
94.140.14.140
84.200.69.80
193.183.98.154
4.2.2.1
1.0.0.1
8.8.4.4
149.112.112.10
94.140.14.141
84.200.70.40
185.121.177.177
4.2.2.2

Note

Resolver reliability varies by location, network policy, provider filtering, and response-format compatibility. The default list favors non-filtering resolvers. Because ReconSR rotates configured resolvers, unreliable, filtering, or incompatible entries can affect only part of the scan and make failures appear intermittent.

HTTP and General Network Request Options

These settings apply to modules that perform HTTP requests and other network operations, including but not limited to external API calls.

Option Default Description
HTTPTimeout 30 Timeout, in seconds, for HTTP requests and other module-level network requests, including RIPE, Shodan, VirusTotal, LeakIX, and similar services.
MaxRetriesHT 3 Maximum retry attempts for HackerTarget API requests.

Example:

[Options]
HTTPTimeout=30
MaxRetriesHT=3

Provider Limits

ReconSR does not provide, manage, or validate third-party API keys, subscriptions, or service limits. Before changing timeout, retry, or pagination values for an external network service, the user must check the current limits in their own account or dashboard for that third-party provider. Free and paid plans may allow different request rates and result volumes.

Certificate Transparency and crt.sh Options

These settings control certificate transparency behavior for the modules/domainsbycerts module, which discovers domains from certificate databases.

Option Default Description
DisableCertspotter false Removes Certspotter from the certificate lookup chain when set to true.
DisableCertExpiredSubdomains false Controls how subdomains from expired certificates are emitted. See details below.
DisableCrtshPG false Removes direct PostgreSQL queries to crt.sh from the certificate lookup chain when set to true.
CrtshPGTimeout 30 Timeout, in seconds, for direct PostgreSQL connections to crt.sh.
MaxRetriesCert 3 Maximum retry attempts for certificate transparency lookups.

Certificate Lookup Chain

ReconSR uses a fallback chain for certificate-based domain discovery:

  1. Query Certspotter first. It is fast, but may enforce limits by source IP address.
  2. If Certspotter is unavailable, query crt.sh PostgreSQL directly.
  3. If crt.sh PostgreSQL is unavailable or disabled, query the standard crt.sh API, which is slower and often less stable.

The disable flags remove specific steps from this chain:

  • Set DisableCertspotter=true to skip Certspotter and query crt.sh PostgreSQL first.
  • Set DisableCrtshPG=true to skip direct PostgreSQL access and use the standard crt.sh API when needed.
  • If both DisableCertspotter=true and DisableCrtshPG=true are set, ReconSR goes directly to the standard crt.sh API.

Expired Certificate Subdomain Handling

DisableCertExpiredSubdomains changes how ReconSR handles subdomains discovered only from expired certificates:

  • When set to false, expired-certificate subdomains are aggregated into a summary property on the root domain.
  • When set to true, each expired-certificate subdomain is emitted as an individual node into the system.

Use individual nodes when expired-certificate findings are important for historical infrastructure analysis. Use aggregation when you want a cleaner graph with fewer low-confidence nodes.

Example:

[Options]
DisableCertspotter=false
DisableCertExpiredSubdomains=false
DisableCrtshPG=false
CrtshPGTimeout=30
MaxRetriesCert=3

WHOIS and RDAP Options

These settings control domain registration lookups and RDAP behavior.

Option Default Description
DisableRDAP false Disables RDAP and falls back to legacy WHOIS over port 43 when set to true.
MaxRetriesWhois 3 Maximum retry attempts for WHOIS and RDAP queries.

RDAP Versus WHOIS

By default, ReconSR queries RDAP first. If RDAP is not available for a domain zone, ReconSR falls back to legacy WHOIS automatically.

Set DisableRDAP=true when you want ReconSR to skip RDAP entirely and always query legacy WHOIS first.

Example:

[Options]
DisableRDAP=false
MaxRetriesWhois=3

ASN Metadata Options

These settings control ASN metadata lookups and ASN transit chain traversal.

Option Default Description
TimeoutASNMeta 30 HTTP timeout, in seconds, for ASN metadata API lookups.
MaxRetriesASNMeta 3 Maximum retry attempts for ASN metadata lookups.
MaxRecursionDepth 3 Maximum depth for ASN transit chain traversal.

Warning

Increase MaxRecursionDepth with caution. A deeper ASN transit chain increases lookup time. On very large ASNs, high values can cause unpredictable results, including very long scans or IP-based blocking by RIPEstat.

Example:

[Options]
TimeoutASNMeta=30
MaxRetriesASNMeta=3
MaxRecursionDepth=3

IP Metadata Options

IP metadata settings control retry behavior for enrichment modules that collect information about IP addresses.

Option Default Description
MaxRetriesIPMeta 3 Maximum retry attempts for IP metadata lookups.

Example:

[Options]
MaxRetriesIPMeta=3

Mailcrypto Options

Mailcrypto settings control whether domains and subdomains are routed to the mailcrypto brute-force handler.

Option Default Description
DisableMailcryptoBruteForce true Prevents domains and subdomains from being routed to the mailcrypto brute-force handler when set to true.

Example:

[Options]
DisableMailcryptoBruteForce=true

When to Enable Mailcrypto Brute Force

Set DisableMailcryptoBruteForce=false only when you intentionally want modules/mailcrypto to perform brute-force checks for SMIMEA and OPENPGPKEY records.

When enabled, ReconSR checks the following 15 common email local parts for each domain and subdomain, for both SMIMEA and OPENPGPKEY records:

admin
administrator
postmaster
hostmaster
security
webmaster
info
it
support
sales
contact
billing
noc
abuse
hello

Anubis Options

Anubis settings control how many historical subdomain records ReconSR processes for a domain from anubisdb.com.

Option Default Description
AnubisLimit 1000 Maximum number of subdomains to process from Anubis. The service can support values up to 10000.

Example:

[Options]
AnubisLimit=1000

VirusTotal Options

VirusTotal settings control request pacing, retry behavior, subdomain routing, and pagination.

Note

VirusTotal requires an API key. See API Credentials for credential configuration.

Option Default Description
VirustotalDelayMs 15000 Delay, in milliseconds, between VirusTotal API requests.
VirustotalMaxRetries 3 Maximum retry attempts for VirusTotal API requests.
VirustotalScanSubdomains false Routes subdomains to the VirusTotal domain endpoint in addition to root domains when set to true.
VirustotalMaxPages 5 Maximum number of pages to fetch. Each page can fetch up to 40 objects.

Example:

[Options]
VirustotalDelayMs=15000
VirustotalMaxRetries=3
VirustotalScanSubdomains=false
VirustotalMaxPages=5

VirusTotal Rate Limits

The default VirustotalDelayMs=15000 value is set for the free-tier limit of 4 requests per minute. Paid VirusTotal subscriptions may have different limits. Change VirustotalDelayMs only when the selected API plan allows a different request rate.

Warning

Enabling VirustotalScanSubdomains or increasing VirustotalMaxPages can make scans take longer, especially on free-tier plans limited to 4 requests per minute. These settings can also exhaust the available VirusTotal API quota.

Shodan Options

Shodan settings control domain lookups, DNS history, result filtering, pagination, and IP banner behavior.

Note

Shodan requires an API key. See API Credentials for credential configuration.

Option Default Description
ShodanScanSubdomains false Routes subdomains to the Shodan domain endpoint in addition to root domains when set to true. Each lookup costs 1 query credit.
ShodanDomainHistory false Includes historical DNS data in Shodan domain lookup results when set to true.
ShodanDomainType empty Filters Shodan domain results by DNS type. Supported values are A, AAAA, CNAME, NS, SOA, MX, and TXT. Empty returns all types.
ShodanMaxDomainPages 1 Maximum number of pages to fetch for Shodan domain lookups. Each page costs 1 query credit.
ShodanIPHistory false Includes all historical banners in Shodan IP lookup results when set to true.
ShodanIPMinify false Returns only ports and general host information without full banners for Shodan IP lookups when set to true.

Example:

[Options]
ShodanScanSubdomains=false
ShodanDomainHistory=false
ShodanDomainType=
ShodanMaxDomainPages=1
ShodanIPHistory=false
ShodanIPMinify=false

Warning

Enabling ShodanScanSubdomains or increasing ShodanMaxDomainPages can quickly consume Shodan query credits. Each separate successful Shodan domain request costs 1 query credit.

Shodan Domain Type Examples

ShodanDomainType accepts the following values: A, AAAA, CNAME, NS, SOA, MX, and TXT. Leave the value empty to return all supported record types.

ShodanDomainType=A
ShodanDomainType=MX

IPinfo Options

IPinfo settings control which API endpoint is used based on your subscription tier.

Note

IPinfo requires an API key. See API Credentials for credential configuration.

Option Default Description
IPINFOPaid false Set to true if your configured API key belongs to a paid tier (Core, Plus, Max). This enables the rich lookup endpoint. Note: Enterprise tier is not supported.

Example:

[Options]
IPINFOPaid=false

AbuseIPDB Options

AbuseIPDB settings control the reporting window used for IP reputation checks.

Note

AbuseIPDB requires an API key. See API Credentials for credential configuration.

Option Default Description
AbuseIPDBmaxAgeInDays 30 Number of days to look back when fetching reports. Valid range is 1 to 365.

Example:

[Options]
AbuseIPDBmaxAgeInDays=30

CIRCL Options

CIRCL settings control vulnerability enrichment depth, optional linked data, retry behavior, and retry delay.

Option Default Description
CirclWithMeta true Includes metadata for CIRCL vulnerabilities.
CirclWithLinked false Includes linked vulnerabilities.
CirclWithComments false Includes comments.
CirclWithBundles false Includes bundles.
CirclWithSightings false Includes sightings.
MaxRetriesCircl 3 Maximum retry attempts for CIRCL API requests.
CirclRetryBaseDelay 5 Base pause, in seconds, for exponential backoff between CIRCL API retry attempts.

Example:

[Options]
CirclWithMeta=true
CirclWithLinked=false
CirclWithComments=false
CirclWithBundles=false
CirclWithSightings=false
MaxRetriesCircl=3
CirclRetryBaseDelay=5

LeakIX Options

LeakIX settings control retry behavior for the LeakIX API module.

Note

LeakIX requires an API key. See API Credentials for credential configuration.

Option Default Description
MaxRetriesLeakIX 3 Maximum retry attempts for LeakIX API requests.

The module enforces its own internal rate limit of approximately 1 request per second. On HTTP 429 responses, the module respects the x-limited-for header returned by the API to determine the backoff duration.

Example:

[Options]
MaxRetriesLeakIX=3

Hunter.io Options

Hunter.io settings control email discovery filters, organization processing, pagination, and retries.

Note

Hunter.io requires an API key. See API Credentials for credential configuration.

Option Default Description
HunterioLimit 10 Maximum number of email addresses to return per page. The free tier supports up to 10; the maximum supported value is 100.
HunterioType empty Filters email addresses by type. Supported values are personal and generic. Empty returns all types.
HunterioSeniority empty Filters by seniority level. Supported values are junior, senior, and executive. Multiple values can be comma-delimited.
HunterioDepartment empty Filters by department. Supported values include executive, it, finance, management, sales, legal, support, hr, marketing, communication, education, design, health, and operations. Multiple values can be comma-delimited.
HunterioScanOrg false Enables processing of organization entities through the company endpoint.
HunterioMaxPages 1 Maximum number of pages to fetch for Hunter.io domain lookups.
HunterioMaxRetries 3 Maximum retry attempts for Hunter.io API requests.

Example:

[Options]
HunterioLimit=10
HunterioType=
HunterioSeniority=
HunterioDepartment=
HunterioScanOrg=false
HunterioMaxPages=1
HunterioMaxRetries=3

Hunter.io Filter Examples

HunterioType=personal
HunterioSeniority=senior,executive
HunterioDepartment=it,operations

Have I Been Pwned Options

Have I Been Pwned settings control request pacing and retry behavior.

Note

Have I Been Pwned email-lookup requests require a paid subscription. See API Credentials for credential configuration.

Option Default Description
HaveIBeenPwnedDelayMs 65 Delay, in milliseconds, between Have I Been Pwned API requests.
HaveIBeenPwnedMaxRetries 3 Maximum retry attempts for Have I Been Pwned API requests.

Example:

[Options]
HaveIBeenPwnedDelayMs=65
HaveIBeenPwnedMaxRetries=3

Warning

The default Have I Been Pwned delay is intended for the lowest paid tier. Change HaveIBeenPwnedDelayMs only for higher-tier subscriptions, and select the delay according to the request limits of your plan.

Netlas Options

Netlas settings control request retries, subdomain scanning, and bulk download limits.

Note

Netlas requires an API key. See API Credentials for credential configuration.

Option Default Description
MaxRetriesNetlas 3 Maximum retry attempts for Netlas API requests.
NetlasRetryBaseDelay 2 Fallback base pause between Netlas API retry attempts (used if Retry-After header is missing), in seconds.
NetlasScanSubdomains false Enable routing of subdomains to the Netlas domain endpoint in addition to root domains when set to true.
NetlasLimitPerOneDownload empty Maximum number of results to download per request using the domains/download endpoint. If empty or 0, the download functions are disabled. If set, ReconSR downloads the minimum of this configured limit, the available count, and your plan's Limit per one download.
NetlasDownloadTimeout 300 Timeout specifically for Netlas data downloads (e.g., NDJSON streaming from the domains/download endpoint), in seconds. Set this high enough to allow large datasets to download without interruption, but be aware of the global function timeout.

Warning

For NetlasLimitPerOneDownload: Each download API call decreases the Request Limit by 1, and consumes 1 Search Coin for each document retrieved from the Netlas database. Setting a very high limit will result in a prolonged wait for the API to stream the NDJSON response. If the global function timeout is exceeded before the download completes, the process will be canceled and data may be lost.

Netlas Download Limit Logic

ReconSR intelligently calculates the exact number of records to download to prevent exceeding your plan limits and to respect your configuration constraints. The logic works as follows:

  1. ReconSR checks your API key profile to determine your pricing plan's Limit per one download.
  2. If the download function is active (NetlasLimitPerOneDownload > 0), ReconSR makes 1 free request to the Netlas API to get the total count of available domains (e.g., domains sharing the same IP or related to a root domain).
  3. It then compares three values: your configured NetlasLimitPerOneDownload, the total available count, and your plan's limit. ReconSR will always request the minimum of these three values.

Examples:

  • Example 1 (Free Tier limit reached): A Free Tier user has a plan limit of 200. The user sets NetlasLimitPerOneDownload=1000. The total count of available domains is 10000. ReconSR will request 200 objects (the minimum of 1000, 10000, and 200).

  • Example 2 (User configuration constraint): A Corporate Tier user has a plan limit of 10000000. The user sets NetlasLimitPerOneDownload=1000. The total count of available domains is 40000. ReconSR will request 1000 objects (the minimum of 1000, 40000, and 10000000).

Configuration Example

[Options]
MaxRetriesNetlas=3
NetlasRetryBaseDelay=2
NetlasScanSubdomains=false
NetlasLimitPerOneDownload=
NetlasDownloadTimeout=300

Default Settings Guidance

Keep the default settings unless you understand the operational and cost impact of each change. If you are unsure which value to change, leave the default value in place.

Paid API subscriptions may support higher request rates, larger page counts, or broader enrichment than free or low-tier plans. ReconSR does not know your subscription level and cannot infer provider limits automatically. Match each setting to the documented quota in your own third-party service account.

Complete Default Example

The following example shows the default network configuration.

[Options]

### General Network & Retry Options ###
Timeout=10
KeepAlive=30
RetryBaseDelay=2

### DNS Options ###
DNSQueryTimeout=10
DNSFallbackTimeout=15
DNSBruteTimeout=40
DNSConcurrency=10
MaxRetriesDNS=3

### HTTP & General Network Request Options ###
HTTPTimeout=30
MaxRetriesHT=3

### Certificate & crt.sh Options ###
DisableCertspotter=false
DisableCertExpiredSubdomains=false
DisableCrtshPG=false
CrtshPGTimeout=30
MaxRetriesCert=3

### WHOIS and RDAP Options ###
DisableRDAP=false
MaxRetriesWhois=3

### ASN Metadata Options ###
TimeoutASNMeta=30
MaxRetriesASNMeta=3
MaxRecursionDepth=3

### IP Metadata Options ###
MaxRetriesIPMeta=3

### Mailcrypto Options ###
DisableMailcryptoBruteForce=true

### Anubis Options ###
AnubisLimit=1000

### VirusTotal Options ###
VirustotalDelayMs=15000
VirustotalMaxRetries=3
VirustotalScanSubdomains=false
VirustotalMaxPages=5

### Shodan Options ###
ShodanScanSubdomains=false
ShodanDomainHistory=false
ShodanDomainType=
ShodanMaxDomainPages=1
ShodanIPHistory=false
ShodanIPMinify=false

### AbuseIPDB Options ###
AbuseIPDBmaxAgeInDays=30

### CIRCL Options ###
CirclWithMeta=true
CirclWithLinked=false
CirclWithComments=false
CirclWithBundles=false
CirclWithSightings=false
MaxRetriesCircl=3
CirclRetryBaseDelay=5

### Hunter.io Options ###
HunterioLimit=10
HunterioType=
HunterioSeniority=
HunterioDepartment=
HunterioScanOrg=false
HunterioMaxPages=1
HunterioMaxRetries=3

### Have I Been Pwned Options ###
HaveIBeenPwnedDelayMs=65
HaveIBeenPwnedMaxRetries=3

### IPinfo Options ###
IPINFOPaid=false

### LeakIX Options ###
MaxRetriesLeakIX=3

### Netlas Options ###
NetlasScanSubdomains=false
NetlasLimitPerOneDownload=0
MaxRetriesNetlas=3
NetlasRetryBaseDelay=2
NetlasDownloadTimeout=300

[DoH]
https://dns.cloudflare.com/dns-query
https://dns.google/resolve
https://unfiltered.adguard-dns.com/resolve
https://mozilla.cloudflare-dns.com/dns-query
https://doh.dns.sb/dns-query

[Plain]
1.1.1.1
8.8.8.8
9.9.9.10
94.140.14.140
84.200.69.80
193.183.98.154
4.2.2.1
1.0.0.1
8.8.4.4
149.112.112.10
94.140.14.141
84.200.70.40
185.121.177.177
4.2.2.2

🚀 Getting Started

⚙️ Configuration

🔌 Integrations

🧠 Intelligence Modules

Clone this wiki locally