9.2.4 Expand the host map through DNS records and zone transfers DNS Enumeration

← Stage index · Cheatsheet | Strategy map | Study methods: Extract opportunities from services

Recognize: DNS uses UDP/53 for most queries and TCP/53 for operations including conventional zone transfers and oversized responses. Prerequisite: a known or inferred domain for meaningful record and name enumeration.

9.2.4.1 Baseline: query the target DNS server directly

dig @TARGET DOMAIN SOA
dig @TARGET DOMAIN NS
dig @TARGET DOMAIN A
dig @TARGET DOMAIN MX
dig @TARGET DOMAIN TXT

Decisive output: ANSWER records disclose names, addresses, mail exchangers or text. The aa flag supports an authoritative answer. Record status separately from the answer count.

9.2.4.1.1 Variant — reverse lookup and zone transfer

dig @TARGET -x IP
dig @TARGET DOMAIN AXFR

A successful AXFR returns the zone records and closing SOA. Transfer failed, REFUSED or NOTAUTH only disproves an unauthenticated transfer from this source; continue ordinary queries.

9.2.4.1.2 Variant — name guessing after the domain is known

dnsrecon -d DOMAIN -n TARGET -t std
dnsrecon -d DOMAIN -n TARGET -D WORDLIST -t brt
dnsenum --dnsserver TARGET DOMAIN

Check wildcard behavior before trusting large result sets. Every resolved in-scope name becomes a new discovery/service-enumeration input.

9.2.4.1.3 Variant — reverse sweep of an explicitly assigned range

dnsrecon -r SUBNET -n TARGET

Use this only when the entire SUBNET is assigned. PTR names are clues; resolve/scan only in-scope results.

9.2.4.1.4 Variant — host and Windows nslookup

host -t mx DOMAIN TARGET
host -t txt DOMAIN TARGET

nslookup HOST.DOMAIN TARGET
nslookup -type=TXT HOST.DOMAIN TARGET
nslookup -type=MX DOMAIN TARGET

Failure cues: NXDOMAIN means that queried name does not exist in that view; NOERROR with no answer can mean the name exists but lacks that record type. Timeout can be filtering, loss or a silent/unreachable server. A recursive answer does not establish that the server is authoritative.

Next action: add new hostnames/IPs to the scoped queue, correlate naming roles with observed services, and repeat discovery/service identification for those in-scope endpoints.