I'm using nmap to scan a given domain name example.com, which resolves to 2 ip addresses, then nmap chooses only one ip address to scan

for example:

#nmap -vv -sV scanme.nmap.org
Starting Nmap 7.01 ( https://nmap.org ) at 2016-11-01 15:52 CET
NSE: Loaded 35 scripts for scanning.
Warning: Hostname scanme.nmap.org resolves to 2 IPs. Using
Initiating Ping Scan at 15:52
Scanning scanme.nmap.org ( [4 ports]
Completed Ping Scan at 15:52, 0.17s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 15:52
Completed Parallel DNS resolution of 1 host. at 15:52, 0.30s elapsed
Initiating SYN Stealth Scan at 15:52
Scanning scanme.nmap.org ( [1000 ports]
Discovered open port 22/tcp on
Discovered open port 80/tcp on
Discovered open port 9929/tcp on

is there an option to force nmap to scan all 2 ip address, not just one? thanks

  • prefer to ask questions related to information security Nov 1, 2016 at 15:24
  • usually you would first scan that entire network range, then submit the IP addresses into nmap as a list
    – Rory Alsop
    Nov 1, 2016 at 15:26
  • dig +short <domainname> | sudo xargs nmap -vv -sV Nov 1, 2016 at 15:26
  • i'm aware of these workarounds, thanks, but I'm asking to see if nmap have an option to support this natively
    – ksr
    Nov 1, 2016 at 16:05

3 Answers 3


Nmap has a script to do this, resolveall. The interface isn't as nice as it could be: you have to provide the hostname via the resolveall.hosts script argument. Here's how to do that and also add any resolved addresses to the scan queue:

nmap --script resolveall --script-args newtargets,resolveall.hosts=example.com

EDIT: As mentioned in the comments, Nmap 7.40 and later does not require the resolveall.hosts script argument; you can provide targets directly on the command line or with -iL as you usually would. The newtargets argument is required to add the resolved addresses to the scan queue instead of just listing them in the script's output. Future releases of Nmap (newer than 7.60) will have non-NSE capability to do this, but the options and syntax have not been decided yet.

EDIT 2: Nmap 7.70 (released today) has this functionality built-in with the --resolve-all option. No need to use the resolveall NSE script, which will be removed in a future release, and no need to use the newtargets script argument.

  • 1
    Thanks! but what if I have a text file with a list of domain names, can I use the -iL option, or there's an alternative?
    – ksr
    Nov 2, 2016 at 7:15
  • @ksr I just added this to the script last night. Thanks for pointing it out! Nov 3, 2016 at 16:37
  • great! r u the author? can u give us link to the modified version? thanks!
    – ksr
    Nov 6, 2016 at 15:04
  • can u provide an example command with arguments, how the new modified version will be used with nmap
    – ksr
    Nov 6, 2016 at 15:23
  • 1
    @ksr download from the documentation page: nmap.org/nsedoc/scripts/resolveall.html . Example: nmap -iL targets.txt --script resolves --script-args newtargets Nov 6, 2016 at 15:37

There is a "--resolve-all" parameter since Nmap 7.70 [2018-03-20] which does just that https://nmap.org/changelog.html

To make Nmap scan all the resolved addresses instead of only the first one, use the --resolve-all option.


You can run a for loop:
for srv in $(host example.com |awk '{print $4}'); do nmap $srv; done

or if you have a list with one entry per line:
for srv in $(cat list.txt); do nmap $srv; done

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .