Dnsrecon

DNSRecon

Purpose

Use this skill for focused DNS enumeration when the engagement needs more structure than passive subdomain discovery alone.

Phase Fit

• Primary: Discovery and Reconnaissance
• Secondary: Threat Modeling and Test Planning, Retest and Closure

Use When

• Need to inspect DNS records, subdomains, and service exposure.
• Need to correlate DNS information into a stronger attack-surface map.
• Need a repeatable DNS retest after cleanup.

Avoid When

• Domain ownership or scope is unclear.
• Aggressive DNS enumeration is not approved.

Inputs

• Approved domain
• Record scope and recursion limits
• Exclusions and evidence requirements

Procedure

1. Start with the minimum record and host scope needed.
2. Record only material DNS relationships and exposures.
3. Correlate findings with asset inventory and HTTP probing.
4. Label unverified or third-party assets clearly.
5. Preserve the enumeration scope for retest.

Command Syntax

Replace sample domains with approved in-scope targets.

# Standard record enumeration
dnsrecon -d contoso.com -t std

# Zone transfer attempt
dnsrecon -d contoso.com -t axfr

# Subdomain brute-force
dnsrecon -d contoso.com -t brt -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Reverse lookup of a range
dnsrecon -r 10.10.10.0/24 -n 10.10.10.10

# SRV record enumeration
dnsrecon -d contoso.com -t srv

# Output to JSON
dnsrecon -d contoso.com -t std -j contoso-dnsrecon.json

Evidence to Capture

• DNS records and subdomains that materially affect exposure
• Exact enumeration mode and domain used
• Assets requiring confirmation or follow-up validation

Safety Boundaries

• Keep enumeration within approved domain boundaries.
• Do not treat discovered names as confirmed in-scope assets until ownership is validated.