DNSenum

DNSenum actively queries DNS servers, attempts zone transfers, and brute-forces subdomains, making it an active reconnaissance tool. Subfinder is passive-only — it queries public sources like certificate transparency logs and never sends traffic to the target. Use DNSenum for active DNS testing; use Subfinder for stealthy passive enumeration.

Yes. DNSenum attempts DNS zone transfer (AXFR) against name servers discovered for the target domain. A successful zone transfer reveals the entire DNS zone file, including all subdomains, IP addresses, and record types. Use --noreverse to skip reverse lookups and focus on zone transfer attempts.

Use the -f flag to specify a custom wordlist for subdomain brute-forcing: dnsenum -f /usr/share/wordlists/subdomains.txt example.com. For comprehensive results, combine with --threads N for multi-threaded scanning and --subfile output.txt to save discovered subdomains.

DNSenum is safe to use on domains you own or have explicit authorization to test. It is an active tool that sends DNS queries to target servers, which may be logged and detected. Unauthorized DNS enumeration may violate computer fraud laws. Always obtain written permission before scanning domains you do not own.

DNSenum discovers A, AAAA, MX, NS, SOA, TXT, and CNAME records. It also performs reverse DNS lookups to map IP addresses back to hostnames and attempts zone transfers to retrieve the complete zone file from misconfigured name servers.

DNSenum is specialized for DNS enumeration — it focuses on DNS records, zone transfers, and subdomain brute-forcing with multi-threaded performance. Nmap has broader capabilities including port scanning, service detection, and OS fingerprinting but is less focused on DNS-specific tasks. Use DNSenum for DNS recon, then Nmap for port scanning discovered hosts.

DNSenum is a multithreaded Perl script for DNS enumeration that gathers DNS records (A, AAAA, MX, NS, SOA, TXT, CNAME), attempts zone transfers (AXFR), brute-forces subdomains, and performs reverse DNS lookups. It is a standard reconnaissance tool in Kali Linux used for mapping a target domain's DNS infrastructure during penetration testing and OSINT investigations.

DNSenum performs four main functions: (1) gathers DNS records including A, AAAA, MX, NS, SOA, TXT, and CNAME records; (2) attempts DNS zone transfer to retrieve the complete zone file; (3) brute-forces subdomains using dictionary attacks; and (4) performs reverse DNS lookups to map IP addresses back to hostnames. These capabilities make DNSenum a comprehensive DNS reconnaissance tool.

Install DNSenum with sudo apt install dnsenum, then run dnsenum <domain> for basic enumeration. Use --enum for full enumeration with reverse lookups, -f wordlist.txt for custom subdomain brute-force, --threads N for multi-threaded scanning, and --noreverse to skip reverse lookups. Save output with > output.txt and discovered subdomains with --subfile subs.txt.

DNSenum comes pre-installed on Kali Linux. Open a terminal and run sudo apt install dnsenum to ensure it is installed. Then use dnsenum <domain> for basic enumeration. For a complete dnsenum kali linux tutorial, start with dnsenum example.com, review the output, then try dnsenum --enum example.com for full enumeration with reverse lookups and subdomain discovery.

DNSenum is used for DNS reconnaissance during penetration testing and OSINT investigations. It maps a target's DNS infrastructure by discovering subdomains, mail servers, name servers, and IP addresses. Security professionals use it to identify the attack surface, test for zone transfer vulnerabilities, and build comprehensive domain profiles for further analysis with tools like Nmap, Nikto, and Gobuster.

DNSenum is safe to use on domains you own or have explicit authorization to test. It is an active tool that sends DNS queries to target servers, which may be logged and detected. Unauthorized DNS enumeration may violate computer fraud laws. Always obtain written permission before scanning domains you do not own. Use lab environments like HackTheBox or TryHackMe for practice.

DNSenum discovers A records (IPv4 addresses), AAAA records (IPv6 addresses), MX records (mail servers with priority), NS records (authoritative name servers), SOA records (start of authority with zone metadata), TXT records (text annotations including SPF/DKIM), and CNAME records (canonical name aliases). It also discovers subdomains through zone transfer attempts and brute-force enumeration.

Yes, DNSenum discovers subdomains through two methods: zone transfer attempts (AXFR requests that may return the complete zone file) and dictionary-based brute-force using the -f flag. Zone transfers are rarely permitted on modern DNS servers, so subdomain brute-force is the primary discovery method. Use comprehensive wordlists from SecLists for the best results.

DNSenum brute force is a dictionary-based subdomain discovery technique that queries the target DNS server with thousands of potential subdomain names from a wordlist. When a subdomain exists, the DNS server responds with its IP address. Use dnsenum -f wordlist.txt <domain> to specify a custom wordlist. The default wordlist is small — download SecLists for comprehensive discovery with 5000+ entries.

DNSenum reverse lookup (PTR record query) maps discovered IP addresses back to hostnames. This reveals additional infrastructure, shared hosting arrangements, and hostnames not found through forward DNS enumeration. Enable reverse lookups with dnsenum --enum or disable them with --noreverse for faster scanning. Reverse DNS is essential for complete infrastructure mapping.

A DNS zone transfer (AXFR) is a mechanism for replicating DNS zone files between servers. DNSenum attempts to request a zone transfer from the target's primary name server, which if successful returns the complete list of all registered subdomains and DNS records. Most modern DNS servers block unauthorized zone transfers, so this is a security test as well as an enumeration technique.

DNSenum is included in Kali Linux by default. Run sudo apt install dnsenum to install or update it. On other Linux distributions, you can clone it from GitHub: git clone https://github.com/fwaeyt/dnsenum.git, then run it with perl dnsenum.pl <domain>. No additional dependencies are required beyond Perl, which is pre-installed on most systems.

DNSenum automates the entire enumeration workflow — gathering records, testing zone transfers, and brute-forcing subdomains in a single command. Dig requires manual queries for each record type but provides more detailed output including TTL values, record flags, and authoritative response data. Use DNSenum for rapid discovery and Dig for deep analysis of specific records.

Common DNSenum errors include: 'NXDOMAIN' (domain doesn't exist — check spelling), 'REFUSED' (DNS server blocks queries — try different resolver with --dnsserver), 'timed out' (increase --timeout value), and empty zone transfer results (target blocks AXFR — this is normal, use -f for brute-force instead). If DNSenum hangs, reduce --threads or add --noreverse to skip reverse lookups.

Avoid these common mistakes: (1) Not using a wordlist — the default wordlist is tiny, always use -f with SecLists. (2) Expecting zone transfers to succeed — most servers block AXFR, treat it as a bonus. (3) Not saving output — redirect results with > or use --subfile. (4) Running without authorization — always get permission first. (5) Ignoring rate limits — too many threads get you blocked, start with --threads 5.

Top DNSenum alternatives include: Dig (detailed manual DNS queries), Subfinder (passive subdomain discovery from 40+ sources), Amass (large-scale domain mapping with OWASP backing), dnsrecon (Python-based with SRV and cache snooping), and gobuster DNS mode (fast concurrent subdomain brute-force). Use DNSenum for combined zone transfer + brute-force, and Subfinder or Amass for larger-scale reconnaissance.

Use the --dnsserver flag to specify a custom DNS resolver: dnsenum --dnsserver 8.8.8.8 example.com. This is useful when the default system resolver cannot reach the target's authoritative nameservers, or when you want to query from a specific geographic location. You can also use 1.1.1.1 (Cloudflare) or other public resolvers.

The --reverse flag enables reverse DNS lookups (PTR record queries) that map discovered IP addresses back to hostnames. This reveals additional infrastructure like shared hosting servers and hostnames not found through forward DNS. Use --noreverse to disable reverse lookups for faster scanning when IP-to-hostname mapping is not needed.

Dnsenum does not directly query certificate transparency logs. For certificate transparency subdomain discovery, combine dnsenum with tools like crt.sh (queried via curl or theHarvester with -b crtsh). Use dnsenum for DNS record gathering and zone transfer testing, then supplement with certificate transparency sources for comprehensive subdomain coverage.

Dnsenum focuses on DNS record gathering, zone transfer attempts, and subdomain brute-forcing in a single automated workflow. Dnsrecon offers more granular control over individual DNS queries, supports SRV record enumeration, and provides multiple output formats. Dnsenum is better for quick comprehensive scans; dnsrecon is better for targeted DNS research and SRV record discovery.

DNSenum automatically discovers MX records in its standard output. Run dnsenum <domain> and review the MX section for mail server hostnames and priorities. For deeper email infrastructure analysis, combine with dig MX <domain> +short to see all mail exchangers and their preference values, then investigate each with WHOIS.

Yes, DNSenum discovers AAAA records (IPv6 address records) alongside standard A records. Run dnsenum <domain> and look for AAAA entries in the DNS Records section. IPv6 enumeration is important for modern infrastructure mapping since many services run dual-stack configurations.

Save dnsenum subdomains to a file with --subfile subs.txt, then use Nmap to scan them: nmap -iL subs.txt -sV -oN nmap_results.txt. This workflow maps DNS infrastructure first, then probes each discovered host for open ports and running services. Combine with grep to extract IP addresses from dnsenum output for targeted Nmap scans.

DNSenum queries the target domain's authoritative name servers by default, which it discovers from NS records. If the system's default resolver is used, it may query your ISP's DNS instead. Use --dnsserver 8.8.8.8 to force queries through a specific resolver, or query each NS individually with --dnsserver for thorough zone transfer testing.

Yes, dnsenum is valuable for bug bounty reconnaissance. Use it to discover subdomains that host development, staging, or internal applications that may have weaker security. Run dnsenum -f subdomains-top1million-5000.txt to find hidden hosts, then test each for vulnerabilities. Combine with Subfinder for passive subdomain discovery to maximize coverage without triggering security alerts.

When a zone transfer succeeds, dnsenum lists every registered subdomain with its IP address. Look for entries pointing to internal IP ranges (10.x, 172.16-31.x, 192.168.x) that indicate internal infrastructure exposed through DNS. A failed zone transfer message ('Zone transfer failed') is normal — most modern DNS servers block unauthorized AXFR requests. Treat zone transfer success as a critical finding in your security report.

DNSenum provides a more complete workflow by combining record gathering, zone transfer testing, and subdomain brute-forcing in a single command. Fierce focuses specifically on subdomain discovery and adjacent IP range identification. DNSenum is better for comprehensive DNS profiling, while Fierce excels at identifying hosts on neighboring IP addresses that may be part of the target infrastructure.

For comprehensive results, use SecLists DNS wordlists: dnsenum -f /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt <domain>. The built-in wordlist is small and misses common subdomains like api, staging, dev, and admin. For targeted engagements, create custom wordlists using company names, product names, and industry terms. Combine CeWL wordlist generation with dnsenum for maximum effectiveness.

The original DNSenum (by Filip Waeytens and Barbsie) is stable but only lightly maintained, and Google scraping for subdomains is largely broken by modern anti-bot measures. It remains excellent for zone-transfer testing and dictionary brute-force. For actively developed alternatives, pair it with Subfinder and Amass for passive discovery, or dnsrecon for a Python-based option with SRV and cache-snooping features.

Wildcard DNS makes every subdomain guess resolve, flooding your results with false positives. Detect it by querying a random, definitely-nonexistent subdomain first — for example dig randomstring12345.example.com. If it returns an A record, the domain uses a wildcard. When a wildcard is present, filter results by comparing against the wildcard IP, or rely on passive sources like Subfinder instead of brute-force.

Yes. DNSenum queries AAAA records as part of its standard record gathering, so IPv6 hosts appear in the output alongside IPv4 A records. Reverse lookups can also cover IPv6 ranges, though these are often sparse. For granular IPv6 record inspection with TTL and authoritative flags, follow up with Dig using dig AAAA example.com.

DNSenum is an all-in-one enumeration script: it gathers records, attempts zone transfer, brute-forces subdomains, and runs reverse lookups automatically. Dig is a precise, single-query tool that gives granular control over record types, TTL, flags, and authoritative answers. Use DNSenum to map a domain quickly, then use Dig to inspect specific records in depth. They complement each other rather than compete.