How do I install the Recon Dns Analysis skill?

Run npx skillmds@latest add noorqureshi/recon-dns-analysis in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Recon Dns Analysis safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Recon Dns Analysis?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Recon Dns Analysis free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Recon Dns Analysis?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Recon Dns Analysis by noorqureshi — Agent Skill

Name: Recon Dns Analysis
Author: NoorQureshi

Recon Dns Analysis

Deep DNS analysis for attack surface — record mining, zone transfers, DNSSEC/NSEC walking, and dangling records. Load during recon, on "DNS", a domain in scope, or hunting takeovers/origin IPs. Signals: a root domain, CNAMEs, MX/TXT/SPF, NS servers, subdomains to resolve.

NoorQureshi Updated Sep 17, 2026

File contents

DNS analysis

When it applies

Early recon and anytime you want surface/intel from DNS: subdomains, mail/infra hints, cloud providers, dangling records (takeover leads), and origin IPs hiding behind a CDN.

Why it works

DNS is a public map of an org's infrastructure. Records leak providers (CNAME → SaaS), mail and SPF/DMARC hosts, and misconfigurations (open zone transfer dumps everything; NSEC lets you walk a DNSSEC zone). Stale records point at deprovisioned services (→ takeover).

Method

Enumerate records: dig ANY domain, plus explicit A AAAA CNAME MX TXT NS SOA — TXT/SPF reveal third parties; MX reveals mail infra.
Zone transfer (rare but total): find NS (dig NS domain), then dig axfr @ns1 domain — a successful AXFR dumps every record.
DNSSEC walking: if NSEC is used, walk the chain to enumerate names (dnsrecon -t zonewalk).
Dangling / takeover leads: resolve CNAMEs; ones pointing at unclaimed SaaS → web-subdomain-takeover.
Origin discovery: historical DNS (SecurityTrails), SPF-listed IPs, and cert SANs can reveal the real origin behind a CDN (bypass the WAF later).

Gotchas

AXFR is usually refused — but when it works it's the whole zone; always try the NS servers.
CDN/proxied records hide the origin; pivot to cert/historical data, not the proxied A record.
Wildcard DNS inflates brute-force — detect and filter it (dnsx wildcard handling).

Verify success

A richer map: resolvable subdomains, provider/infra hints, any AXFR/NSEC dump, and takeover or origin-IP leads to hand to the next skill.

References

dig/dnsrecon docs; SecurityTrails; OWASP Amass; can-i-take-over-xyz.

---name: recon-dns-analysisdescription: Deep DNS analysis for attack surface — record mining, zone transfers, DNSSEC/NSEC walking, and dangling records. Load during recon, on "DNS", a domain in scope, or hunting takeovers/origin IPs. Signals: a root domain, CNAMEs, MX/TXT/SPF, NS servers, subdomains to resolve.---# DNS analysis## When it appliesEarly recon and anytime you want surface/intel from DNS: subdomains, mail/infra hints, cloudproviders, dangling records (takeover leads), and origin IPs hiding behind a CDN.## Why it worksDNS is a public map of an org's infrastructure. Records leak providers (CNAME → SaaS), mail andSPF/DMARC hosts, and misconfigurations (open zone transfer dumps everything; NSEC lets you walk aDNSSEC zone). Stale records point at deprovisioned services (→ takeover).## Method1. **Enumerate records**: `dig ANY domain`, plus explicit `A AAAA CNAME MX TXT NS SOA` — TXT/SPF reveal third parties; MX reveals mail infra.2. **Zone transfer** (rare but total): find NS (`dig NS domain`), then `dig axfr @ns1 domain` — a successful AXFR dumps every record.3. **DNSSEC walking**: if NSEC is used, walk the chain to enumerate names (`dnsrecon -t zonewalk`).4. **Dangling / takeover leads**: resolve CNAMEs; ones pointing at unclaimed SaaS → `web-subdomain-takeover`.5. **Origin discovery**: historical DNS (SecurityTrails), SPF-listed IPs, and cert SANs can reveal the real origin behind a CDN (bypass the WAF later).## Gotchas- AXFR is usually refused — but when it works it's the whole zone; always try the NS servers.- CDN/proxied records hide the origin; pivot to cert/historical data, not the proxied A record.- Wildcard DNS inflates brute-force — detect and filter it (`dnsx` wildcard handling).## Verify successA richer map: resolvable subdomains, provider/infra hints, any AXFR/NSEC dump, and takeover ororigin-IP leads to hand to the next skill.## References`dig`/`dnsrecon` docs; SecurityTrails; OWASP Amass; can-i-take-over-xyz.

Frequently asked questions