Purpose
Use this skill for focused DNS enumeration when the engagement needs more structure than passive subdomain discovery alone.
Phase Fit
- Primary: Discovery and Reconnaissance
- Secondary: Threat Modeling and Test Planning, Retest and Closure
Use When
- Need to inspect DNS records, subdomains, and service exposure.
- Need to correlate DNS information into a stronger attack-surface map.
- Need a repeatable DNS retest after cleanup.
Avoid When
- Domain ownership or scope is unclear.
- Aggressive DNS enumeration is not approved.
Inputs
- Approved domain
- Record scope and recursion limits
- Exclusions and evidence requirements
Procedure
- Start with the minimum record and host scope needed.
- Record only material DNS relationships and exposures.
- Correlate findings with asset inventory and HTTP probing.
- Label unverified or third-party assets clearly.
- Preserve the enumeration scope for retest.
Command Syntax
Replace sample domains with approved in-scope targets.
# Standard record enumeration
dnsrecon -d contoso.com -t std
# Zone transfer attempt
dnsrecon -d contoso.com -t axfr
# Subdomain brute-force
dnsrecon -d contoso.com -t brt -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
# Reverse lookup of a range
dnsrecon -r 10.10.10.0/24 -n 10.10.10.10
# SRV record enumeration
dnsrecon -d contoso.com -t srv
# Output to JSON
dnsrecon -d contoso.com -t std -j contoso-dnsrecon.json
Evidence to Capture
- DNS records and subdomains that materially affect exposure
- Exact enumeration mode and domain used
- Assets requiring confirmation or follow-up validation
Safety Boundaries
- Keep enumeration within approved domain boundaries.
- Do not treat discovered names as confirmed in-scope assets until ownership is validated.