BeginnerOSINT

DNS Enumeration Guide: Complete Domain Reconnaissance

Master DNS enumeration techniques from basic queries to advanced zone transfers, subdomain brute forcing, and DNS security assessment using Kali Linux tools.

#DNS#Enumeration#Reconnaissance#Subdomain Discovery#Network Scanning

DNS Intelligence Gathering

DNS enumeration is a methodology for systematically extracting intelligence from the Domain Name System. Every domain publishes infrastructure data through its DNS configuration — records, subdomains, service mappings — that collectively reveal how an organization's online presence is structured. Querying these records is a core intelligence-gathering technique that maps the hidden architecture behind any domain.

Why Enumerate DNS?

DNS enumeration reveals:

**A and AAAA records** — IP addresses hosting the domain

**MX records** — Mail servers handling email

**NS records** — Name servers managing DNS

**TXT records** — SPF, DKIM, and other text data

**Subdomains** — Additional services and applications

**Zone transfers** — Complete DNS database (if misconfigured)

**CNAME records** — Aliases and CDN configurations

Prerequisites

Before starting, you should understand:

**DNS basics** — What domains, records, and resolvers are

**Linux commands** — Terminal navigation, piping, and output handling

**Networking fundamentals** — IP addresses, ports, and protocols

Basic DNS Queries

Using dig

# Basic A record lookup
dig example.com

# Short answer format
dig example.com +short

# Query specific record types
dig example.com A +short      # IPv4 addresses
dig example.com AAAA +short   # IPv6 addresses
dig example.com MX +short     # Mail servers
dig example.com NS +short     # Name servers
dig example.com TXT +short    # Text records
dig example.com SOA           # Start of Authority
dig example.com CNAME +short  # Canonical name

# Query a specific DNS server
dig @8.8.8.8 example.com

# Trace the full resolution path
dig example.com +trace

# Reverse DNS lookup
dig -x 8.8.8.8 +short

Using nslookup

# Basic lookup
nslookup example.com

# Query specific record type
nslookup -type=MX example.com
nslookup -type=NS example.com
nslookup -type=TXT example.com

# Use a specific DNS server
nslookup example.com 8.8.8.8

Using host

# Simple DNS lookup
host example.com

# List all records
host -a example.com

# Query specific type
host -t MX example.com
host -t NS example.com

Advanced DNS Enumeration

Zone Transfer Attempt

A DNS zone transfer (AXFR) copies the entire DNS database from a primary server. Misconfigured servers allow anyone to request this:

# Step 1: Find name servers
dig example.com NS +short

# Step 2: Attempt zone transfer from each name server
dig @ns1.example.com example.com AXFR

# Step 3: Using dnsenum for automated testing
dnsenum --enum example.com

# Step 4: Using dnsrecon
dnsrecon -d example.com -t axfr

Subdomain Brute Forcing

Discover subdomains by testing common names against the target:

# Using dnsenum with a wordlist
dnsenum -f /usr/share/wordlists/dns/subdomains-top1million-5000.txt example.com

# Using dnsrecon
dnsrecon -d example.com -D /usr/share/wordlists/dns/subdomains-top1million-20000.txt -t brt

# Using gobuster
gobuster dns -d example.com -w /usr/share/wordlists/dns/subdomains-top1million-5000.txt -t 50

# Using ffuf
ffuf -w /usr/share/wordlists/dns/subdomains.txt:HOST -u http://FUZZ.example.com -fc 400,404,403

Certificate Transparency Logs

Certificate Transparency (CT) logs publicly record all SSL certificates issued:

# Query crt.sh for subdomains
curl -s "https://crt.sh/?q=%25.example.com&output=json" | \
  jq -r '.[].name_value' | sort -u

# Save results
curl -s "https://crt.sh/?q=%25.example.com&output=json" | \
  jq -r '.[].name_value' | sort -u > ct_subdomains.txt

DNS Enumeration Tools

dnsenum

# Full enumeration
dnsenum example.com

# With custom wordlist
dnsenum -f /usr/share/wordlists/dns/subdomains.txt example.com

# Multi-threaded
dnsenum --threads 10 example.com

# Save output
dnsenum --enum -o results.xml example.com

dnsrecon

# Standard enumeration
dnsrecon -d example.com

# Zone transfer test
dnsrecon -d example.com -t axfr

# Subdomain brute force
dnsrecon -d example.com -D wordlist.txt -t brt

# SRV record enumeration
dnsrecon -d example.com -t srv

# Cache snooping
dnsrecon -d example.com -t snoop -D wordlist.txt

# Save results
dnsrecon -d example.com -j output.json

fierce

# Basic subdomain discovery
fierce --domain example.com

# With custom DNS server
fierce --domain example.com --dns-servers 8.8.8.8

DNS Security Assessment

Email Security Records

# Check DMARC policy
dig _dmarc.example.com TXT +short

# Check SPF record
dig example.com TXT +short | grep "v=spf1"

# Check DKIM (common selector names)
dig selector1._domainkey.example.com TXT +short
dig google._domainkey.example.com TXT +short

DNSSEC Validation

# Check if DNSSEC is enabled
dig example.com +dnssec

# Verify DNSSEC chain
delv example.com @8.8.8.8

Common DNS Misconfigurations

# Check for open recursion
dig @target-server example.com

# Test for cache poisoning vulnerability
# Compare responses from multiple DNS servers

# Look for wildcard DNS records
dig *.example.com A +short

Complete DNS Enumeration Script

#!/bin/bash
DOMAIN=$1
OUTPUT_FILE="${DOMAIN}_dns_enum.txt"

echo "=== DNS Enumeration for $DOMAIN ===" | tee "$OUTPUT_FILE"

echo "\n--- A Records ---" | tee -a "$OUTPUT_FILE"
dig "$DOMAIN" A +short | tee -a "$OUTPUT_FILE"

echo "\n--- MX Records ---" | tee -a "$OUTPUT_FILE"
dig "$DOMAIN" MX +short | tee -a "$OUTPUT_FILE"

echo "\n--- NS Records ---" | tee -a "$OUTPUT_FILE"
dig "$DOMAIN" NS +short | tee -a "$OUTPUT_FILE"

echo "\n--- TXT Records ---" | tee -a "$OUTPUT_FILE"
dig "$DOMAIN" TXT +short | tee -a "$OUTPUT_FILE"

echo "\n--- SOA Record ---" | tee -a "$OUTPUT_FILE"
dig "$DOMAIN" SOA +short | tee -a "$OUTPUT_FILE"

echo "\n--- Zone Transfer Test ---" | tee -a "$OUTPUT_FILE"
for ns in $(dig "$DOMAIN" NS +short); do
  echo "Testing $ns..." | tee -a "$OUTPUT_FILE"
  dig @"$ns" "$DOMAIN" AXFR +noall +answer 2>&1 | tee -a "$OUTPUT_FILE"
done

echo "\n--- Subdomain Brute Force ---" | tee -a "$OUTPUT_FILE"
dnsenum -f /usr/share/wordlists/dns/subdomains-top1million-5000.txt "$DOMAIN" 2>&1 | tee -a "$OUTPUT_FILE"

echo "\nResults saved to $OUTPUT_FILE"

Frequently Asked Questions

What is the difference between DNS enumeration and DNS scanning?

DNS enumeration is a passive technique that queries existing DNS records. DNS scanning actively probes for vulnerabilities like zone transfers. Both are essential for complete reconnaissance.

How long does DNS enumeration take?

Basic queries take seconds. Subdomain brute forcing with large wordlists can take minutes to hours depending on wordlist size and thread count.

Is DNS enumeration legal?

Querying public DNS records is legal. However, attempting zone transfers or brute forcing on networks you don't own may violate terms of service or laws. Always have proper authorization.

What wordlist is best for subdomain brute forcing?

The SecLists repository provides excellent wordlists. Start with subdomains-top1million-5000.txt for quick scans, and use larger lists for comprehensive enumeration.

Can DNS enumeration find all subdomains?

No. Private or internal subdomains won't appear in public DNS. CT logs and brute forcing find publicly accessible subdomains only.

Frequently Asked Questions

What is DNS enumeration?

DNS enumeration is the systematic process of discovering all DNS records, subdomains, and infrastructure details for a target domain. It reveals A, AAAA, MX, NS, TXT, and CNAME records plus potential subdomains.

What DNS records should I enumerate?

Essential records include: A/AAAA (IP addresses), MX (mail servers), NS (name servers), TXT (SPF/DKIM/DMARC), CNAME (aliases), and SOA (zone authority). Each reveals different infrastructure information.

What is a DNS zone transfer?

A zone transfer (AXFR) copies the entire DNS database from a primary server. Misconfigured servers allow anyone to request this, revealing all subdomains and records. It's a critical finding during security assessments.

How do you attempt a DNS zone transfer?

Use `dig @ns1.example.com example.com AXFR` or tools like dnsenum (`dnsenum --enum example.com`) and dnsrecon (`dnsrecon -d example.com -t axfr`) for automated testing.

How do you brute force subdomains?

Use wordlists with tools like dnsenum (`dnsenum -f wordlist.txt example.com`), amass, or Gobuster DNS mode. These test common subdomain names against the target and identify valid ones through DNS responses.

What is the difference between dig, nslookup, and host?

dig provides detailed output with full DNS response data. nslookup is simpler and available on most systems. host is the most concise. Use dig for detailed analysis, nslookup for quick checks, and host for simple lookups.

How do you find a domain's name servers?

Use `dig example.com NS +short` or `nslookup -type=NS example.com`. Name servers reveal DNS infrastructure and may indicate relationships between domains sharing the same providers.

What is a TXT record and why is it important?

TXT records contain text information including SPF (email authentication), DKIM (email signing), DMARC (email policy), and domain verification. They reveal email security posture and third-party service integrations.