How do I install the Dnsenum skill?

Run npx skillmds@latest add timsonner/dnsenum in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Dnsenum safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Dnsenum?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Dnsenum free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Dnsenum?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Dnsenum by timsonner — Agent Skill

Name: Dnsenum
Author: timsonner

File contents

DNSEnum

Purpose

Use this skill for classic DNS enumeration when the engagement needs an additional DNS discovery path alongside other recon tools.

Phase Fit

Primary: Discovery and Reconnaissance
Secondary: Threat Modeling and Test Planning, Retest and Closure

Use When

Need to expand the DNS-backed inventory of an approved domain.
Need a second DNS discovery path to compare results.
Need repeatable DNS retesting after exposure changes.

Avoid When

Domain scope is unclear.
Broad DNS brute forcing would exceed the approved depth.

Inputs

Approved domain
Wordlist and recursion limits
Evidence and exclusion requirements

Procedure

Start with the smallest enumeration set that answers the question.
Correlate results with existing DNS and inventory data.
Label unverified names clearly.
Hand confirmed web candidates to httpx or whatweb.
Preserve the exact enumeration scope for retest.

Command Syntax

Replace sample domains with approved in-scope targets.

# Full enumeration (NS, MX, zone transfer attempt)
dnsenum contoso.com

# Full enumeration flag
dnsenum --enum contoso.com

# Subdomain brute-force with custom wordlist
dnsenum --enum contoso.com -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Use specific DNS server
dnsenum --dnsserver 10.10.10.10 contoso.com

# Save output to XML
dnsenum --enum contoso.com -o contoso-dnsenum.xml

Evidence to Capture

DNS names and records that materially expand exposure
Exact enumeration mode and domain used
Gaps between expected and observed DNS surface

Safety Boundaries

Keep enumeration bounded to approved domains.
Do not widen scope from adjacent or similar-looking names without approval.

---name: dnsenumdescription: Use for domain and subdomain enumeration during authorized pentests. Trigger on DNS-backed host discovery, record review, and expanding an approved domain inventory with conservative enumeration depth.license: MIT---# DNSEnum## PurposeUse this skill for classic DNS enumeration when the engagement needs an additional DNS discovery path alongside other recon tools.## Phase Fit- Primary: Discovery and Reconnaissance- Secondary: Threat Modeling and Test Planning, Retest and Closure## Use When- Need to expand the DNS-backed inventory of an approved domain.- Need a second DNS discovery path to compare results.- Need repeatable DNS retesting after exposure changes.## Avoid When- Domain scope is unclear.- Broad DNS brute forcing would exceed the approved depth.## Inputs- Approved domain- Wordlist and recursion limits- Evidence and exclusion requirements## Procedure1. Start with the smallest enumeration set that answers the question.2. Correlate results with existing DNS and inventory data.3. Label unverified names clearly.4. Hand confirmed web candidates to `httpx` or `whatweb`.5. Preserve the exact enumeration scope for retest.## Command SyntaxReplace sample domains with approved in-scope targets.```bash# Full enumeration (NS, MX, zone transfer attempt)dnsenum contoso.com# Full enumeration flagdnsenum --enum contoso.com# Subdomain brute-force with custom wordlistdnsenum --enum contoso.com -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt# Use specific DNS serverdnsenum --dnsserver 10.10.10.10 contoso.com# Save output to XMLdnsenum --enum contoso.com -o contoso-dnsenum.xml```## Evidence to Capture- DNS names and records that materially expand exposure- Exact enumeration mode and domain used- Gaps between expected and observed DNS surface## Safety Boundaries- Keep enumeration bounded to approved domains.- Do not widen scope from adjacent or similar-looking names without approval.

Frequently asked questions

Dnsenum