Skip to main content

DNS Enumeration

Host Lookups​

Basic DNS lookup for A record (IPv4):

host www.$DOMAIN

Search for specific record types:

host -t mx $DOMAIN
host -t txt $DOMAIN
host -t ns $DOMAIN
tip

For MX records, the server with the lowest priority number will be used first to forward mail.

Forward DNS Brute Force​

Use a wordlist to discover hostnames:

for ip in $(cat list.txt); do host $ip.$DOMAIN; done

Reverse DNS Lookups​

If forward brute force reveals IP addresses in the same range, scan that range with reverse lookups (set NET to the discovered /24):

NET=10.10.10
for ip in $(seq 1 254); do host $NET.$ip; done | grep -v "not found"

Tools​

dnsrecon​

Standard scan:

dnsrecon -d $DOMAIN -t std

Brute force with wordlist:

dnsrecon -d $DOMAIN -D ~/list.txt -t brt

-d designates the domain, -t std is standard scan type, -t brt is brute force, and -D specifies the wordlist.

dnsenum​

dnsenum $DOMAIN

dig​

Query specific records (clean, answer-only output):

dig +short A $DOMAIN
dig +noall +answer $DOMAIN MX
dig +short NS $DOMAIN
dig +short TXT $DOMAIN
dig -x <ip>                 # reverse (PTR) lookup
dig @8.8.8.8 $DOMAIN        # query a specific resolver
dig $DOMAIN any

Zone Transfer (AXFR)​

A misconfigured name server may hand over its entire zone. First list the name servers, then attempt a transfer against each:

# 1. Find the authoritative name servers
dig +short NS $DOMAIN

# 2. Attempt AXFR against each NS
dig axfr $DOMAIN @<ns-server>

Equivalent with dnsrecon:

dnsrecon -d $DOMAIN -t axfr
tip

A successful zone transfer dumps every record at once — subdomains, internal hostnames, and mail servers — with no brute forcing required. Always test it first.

nslookup (Windows / interactive)​

When working from a Windows host without dig, nslookup is built in:

nslookup -type=mx $DOMAIN
nslookup
> server <ns-server>
> set type=any
> ls -d $DOMAIN          # attempt zone transfer

Fast Brute Force at Scale​

The host loop above is fine for small lists; for large wordlists use dedicated resolvers:

# dnsx (ProjectDiscovery) — resolve a generated list
dnsx -d $DOMAIN -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# puredns — massdns-backed, handles wildcards
puredns bruteforce /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt $DOMAIN