# Dnsenum

> Use for domain and subdomain enumeration during authorized pentests. Trigger on DNS-backed host discovery, record review, and expanding an approved domain inventory with conservative enumeration depth.

- Skill: `timsonner/dnsenum` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/dnsenum`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/dnsenum/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/dnsenum

---


# DNSEnum

## Purpose

Use this skill for classic DNS enumeration when the engagement needs an additional DNS discovery path alongside other recon tools.

## Phase Fit

- Primary: Discovery and Reconnaissance
- Secondary: Threat Modeling and Test Planning, Retest and Closure

## Use When

- Need to expand the DNS-backed inventory of an approved domain.
- Need a second DNS discovery path to compare results.
- Need repeatable DNS retesting after exposure changes.

## Avoid When

- Domain scope is unclear.
- Broad DNS brute forcing would exceed the approved depth.

## Inputs

- Approved domain
- Wordlist and recursion limits
- Evidence and exclusion requirements

## Procedure

1. Start with the smallest enumeration set that answers the question.
2. Correlate results with existing DNS and inventory data.
3. Label unverified names clearly.
4. Hand confirmed web candidates to `httpx` or `whatweb`.
5. Preserve the exact enumeration scope for retest.

## Command Syntax

Replace sample domains with approved in-scope targets.

```bash
# Full enumeration (NS, MX, zone transfer attempt)
dnsenum contoso.com

# Full enumeration flag
dnsenum --enum contoso.com

# Subdomain brute-force with custom wordlist
dnsenum --enum contoso.com -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Use specific DNS server
dnsenum --dnsserver 10.10.10.10 contoso.com

# Save output to XML
dnsenum --enum contoso.com -o contoso-dnsenum.xml
```

## Evidence to Capture

- DNS names and records that materially expand exposure
- Exact enumeration mode and domain used
- Gaps between expected and observed DNS surface

## Safety Boundaries

- Keep enumeration bounded to approved domains.
- Do not widen scope from adjacent or similar-looking names without approval.