feat(dns): add dns command for Active DNS lookups

[Blevene (Blevene)]

Summary

Adds censys dns <name|ip>..., a command for Censys Active DNS lookups over a time window.

• Name input shows the records the name resolved to (A, AAAA, MX, NS, SOA, TXT).
• IP input shows the domain names that resolved to the IP.
• --timeline shows each observed time range instead of one row per record. --domain narrows an IP timeline to one domain name ("when did this domain point at this IP").
• Several names or IPs can be looked up in one command, up to 100: as positional arguments, comma-separated lists, or from a file (or STDIN) with --input-file. Each is looked up independently — one failing input does not stop the rest.
• Pasted and defanged input works: https://censys.com/path, censys[.]com, hxxp://8.8.8[.]8/x, hxxps[://]censys[.]com. A port (censys.com:443), bracketed IPv6, a CIDR range (including defanged, such as 8[.]8[.]8[.]8/32 and 8.8.8.8[/]32), an @, an empty label, or a non-positive --duration fails with a clear fix before any API call.
• Output: short table by default; json, yaml, tree, template, and --streaming (NDJSON) are all supported.

It is a new top-level command rather than a mode of view or history: view is a point-in-time snapshot, and every DNS endpoint is a time window, so one meaning per command.

$ censys dns censys.com

DNS records for censys.com (46)
Active 2026-09-21 19:13 → 2026-09-28 19:13 UTC

Type   Value                        First Seen         Last Seen
A    | 141.193.213.10             | 2026-05-24 22:14 | 2026-09-27 21:25
MX   | 1 aspmx.l.google.com       | 2026-04-30 21:42 | 2026-09-27 21:25
...

After a short-format view of a single host, a stderr tip now points at censys dns <ip> (suppressed by --quiet), so the new command is discoverable from the one people already run.

Flags

Flag	Default	Function
-s/--start, -e/--end, -d/--duration	-d 7d	Time window (same flags and resolver as history)
-t/--timeline	off	One row per observed time range (API "ranges")
--domain	—	Narrow an IP timeline to one domain name; IP input with --timeline only
-r/--record-type	all	Filter record types (IP input: A, AAAA)
-i/--input-file	—	Read inputs from a file (or STDIN with -); overrides positional arguments
-n/--page-size, -p/--max-pages	100, 10	Pagination; -p -1 fetches all pages
--org-id	—	Standard flag

Requires the Censys Search or Core plan; a 403 names the plan requirement, and (with several inputs) keeps and prints whatever was already fetched before reporting it.

Structure

Same layers as the other commands: internal/command/dns → internal/app/dns → four new GlobalDataClient methods → censys-sdk-go.

Two refactors come first so the new code reuses existing logic instead of copying it:

• internal/app/tags/paginate.go moves to internal/app/pagination (exported; tags only changes imports).
• history's time-window resolver moves to internal/pkg/flags.ResolveTimeWindow.

Deviations from existing patterns

Each deviation and its reason is also in the body of the commit that contains it.

1. New assets.NewDomainName identifier: no FQDN type exists, and the web-property parser accepts host:port without an error.
2. Short output is the default (history defaults to JSON): the closest precedents (censeye, tags, aggregate) show a table first.
3. The tags paginator moves to a shared package: reuse without a second copy.
4. Client methods take record types as []string: the SDK generates four enum types for the same values.
5. resolveTimeWindow moves from history to internal/pkg/flags: one implementation for both commands. It now also rejects a non-positive --duration up front for both commands, instead of letting the API return a 400.
6. Input detection does not use AssetClassifier: it has no domain type and reads a bare name as a web property on 443.
7. The invalid-input error keeps the specific reason (for example "remove the port"): it tells the user how to fix the input.
8. parsePaginationFlags, validatePaginationParams, optionalInt64, and the fetch-all warning are per-package copies: search and tags each own theirs.
9. A stderr note ("Showing N of M records. Use --max-pages -1 to fetch all.") in addition to the "(n of M)" title count: a busy IP can have tens of thousands of records (8.8.8.8: about 61,000 in 7 days). Suppressed by --quiet.
10. dns accepts several inputs, where history takes one: DNS lookups are often run over a list of indicators. Several positional arguments follow tags assign/unassign; --input-file and comma lists in arguments follow view (file lines are not split). The API has no bulk operation, so each input is its own lookup, capped at 100 per command, run one after another; a failed input does not stop the rest, and the command exits 0 if at least one input succeeded, except after a plan error (403), which prints what was already fetched and then exits non-zero.
11. The four DNS record wrappers (NameRecord, NameRangeRecord, IPRecord, IPRangeRecord) define their own MarshalJSON: the SDK's record types already define MarshalJSON, so an embedding wrapper would inherit it and drop the added input field. Every output format (json, yaml, tree, NDJSON) goes through it.
12. view gained a stderr hint pointing at censys dns <ip>, which the dns feature otherwise does not touch: it makes the new command discoverable from the command people already run for a host. Short output of exactly one host only; suppressed by --quiet.
13. refang.RefangURL gained support for the bracketed-scheme defang form ([://], as in hxxps[://]censys[.]com), which the dns feature otherwise does not touch: it was unhandled by any command, and dns showed it worst (a malformed name reaching the API). The fix is in the shared package, so it also benefits view, history, tags, and censeye.
14. The default dns template prints API strings with triple braces (no HTML escaping), unlike the other shipped templates: TXT, SPF, and DKIM values contain quotes and ampersands that HTML escaping would mangle on a terminal. Every string is stripped of control characters before rendering, so nothing unsafe reaches the terminal.
15. An explicitly empty --domain is a usage error, where tags treats a blank filter value as absent: --domain only narrows an IP timeline, so an empty value (for example an unset shell variable) must not silently widen the lookup to every domain.

Testing

• go test ./...: 1858 tests pass.
• Lint: pinned golangci-lint v1.64.8 passes under the go.mod toolchain.
• E2E dns fixtures (go test ./cmd/cencli/e2e/..., CENCLI_ENABLE_E2E_TESTS=true, credentials unset): all no-auth cases pass — help golden, invalid port, bracketed IPv6, CIDR (plain, defanged, and a defanged slash), too many inputs, an invalid list member, @ in a name, an empty label, a non-positive duration, an invalid/mixed record type, and both --domain misuse cases.
• Local live smoke suite (55 cases with real API calls, not committed): 55 passed, 0 failed (1 skipped — no credential on hand that Active DNS denies; covered by the unit tests instead). Covers input parsing (name, defanged, URL, defanged URL, a comma inside a URL path, IPv4, IPv6, an IP inside a URL, the bracketed-scheme defang form), rejections (port, bracketed IPv6, CIDR plain/defanged/defanged slash, too many inputs, email, empty label), bulk lists (name+name, name+IP, IP+name, --input-file, a comma-containing file line kept as one input, combined response metadata for several inputs, JSON with the input field), --timeline (name and IP, plus --domain), no-data output, every flag (record type valid/invalid/mixed, explicit window, zero/negative duration, json/yaml/template output (including a check that each template record prints only its own values), streaming, quiet vs. showing note, fetch-all-pages), --domain misuse, regression checks against history/tags/view, and the new view → dns hint (plain and --quiet).
• CI on PR feat(dns): add dns command for Active DNS lookups #90 (commit d081959): all checks passing, including lint, tests-and-coverage, e2e-native, and e2e-smoke on macOS/Linux/Windows.
• Demo gifs (examples/dns/dns.gif, examples/dns/dns-timeline.gif) recorded with vhs via go run ./cmd/examples dns.

Not in this PR

• A live test of the 403 path with several inputs (no credential on hand is denied Active DNS); unit tests cover it.
• Defang forms with no // at all (for example hxxps:[/][/]host) are not recognized as URLs, so a comma in their path splits them as a list.
• Bulk lookups as a single API operation — the API has none, so several inputs are looked up one at a time.
• Tolerating unknown template entities on config load (Config load fails on an unknown template entity, which breaks older versions after an upgrade #98). After this version writes the new dns template entry to config.yaml, an older cencli that reads the same file fails to load it. This PR does not change config loading; Config load fails on an unknown template entity, which breaks older versions after an upgrade #98 tracks the fix for future versions.

🤖 Generated with Claude Code

[Blevene (Blevene)]

@greptile review

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds a new DNS lookup command to the CLI.

The PR appears safe to merge; the latest changes fix the outstanding early-cancellation panic without introducing a confirmed new issue.

Summary

The PR adds Active DNS lookups for names and IPs, including bulk input, timeline and record-type filtering, pagination, and multiple output formats. It also shares pagination and time-window logic with existing commands and adds a discovery hint to view.

_{Reviews (7) · Last reviewed commit: "fix(dns): report an interruption instead..."}

[Blevene (Blevene)]

@greptile review

[Blevene (Blevene)]

@greptile review

[Blevene (Blevene)]

@greptile review

[Blevene (Blevene)]

@greptile review

[Blevene (Blevene)]

@greptile review

[Blevene (Blevene)]

@greptile review