# Dnsrecon

> Use for DNS enumeration during authorized pentests. Trigger on zone review, host discovery, record correlation, and building a more complete DNS-backed inventory for approved domains.

- Skill: `timsonner/dnsrecon` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/dnsrecon`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/dnsrecon/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/dnsrecon

---


# DNSRecon

## Purpose

Use this skill for focused DNS enumeration when the engagement needs more structure than passive subdomain discovery alone.

## Phase Fit

- Primary: Discovery and Reconnaissance
- Secondary: Threat Modeling and Test Planning, Retest and Closure

## Use When

- Need to inspect DNS records, subdomains, and service exposure.
- Need to correlate DNS information into a stronger attack-surface map.
- Need a repeatable DNS retest after cleanup.

## Avoid When

- Domain ownership or scope is unclear.
- Aggressive DNS enumeration is not approved.

## Inputs

- Approved domain
- Record scope and recursion limits
- Exclusions and evidence requirements

## Procedure

1. Start with the minimum record and host scope needed.
2. Record only material DNS relationships and exposures.
3. Correlate findings with asset inventory and HTTP probing.
4. Label unverified or third-party assets clearly.
5. Preserve the enumeration scope for retest.

## Command Syntax

Replace sample domains with approved in-scope targets.

```bash
# Standard record enumeration
dnsrecon -d contoso.com -t std

# Zone transfer attempt
dnsrecon -d contoso.com -t axfr

# Subdomain brute-force
dnsrecon -d contoso.com -t brt -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Reverse lookup of a range
dnsrecon -r 10.10.10.0/24 -n 10.10.10.10

# SRV record enumeration
dnsrecon -d contoso.com -t srv

# Output to JSON
dnsrecon -d contoso.com -t std -j contoso-dnsrecon.json
```

## Evidence to Capture

- DNS records and subdomains that materially affect exposure
- Exact enumeration mode and domain used
- Assets requiring confirmation or follow-up validation

## Safety Boundaries

- Keep enumeration within approved domain boundaries.
- Do not treat discovered names as confirmed in-scope assets until ownership is validated.