Expand names through DNS records and zone transfers

Needs: Reachable DNS transport and relevant authoritative zone; AXFR requires an allowed TCP zone transfer

Query the target DNS server directly

Recognize: DNS uses UDP/53 for most queries and TCP/53 for operations including conventional zone transfers and oversized responses. Prerequisite: a known or inferred domain for meaningful record and name enumeration.

# Baseline: query the target DNS server directly
dig @TARGET DOMAIN SOA
dig @TARGET DOMAIN NS
dig @TARGET DOMAIN A
dig @TARGET DOMAIN MX
dig @TARGET DOMAIN TXT

# Variant — reverse lookup and zone transfer
dig @TARGET -x IP
dig @TARGET DOMAIN AXFR

# Variant — name guessing after the domain is known
dnsrecon -d DOMAIN -n TARGET -t std
dnsrecon -d DOMAIN -n TARGET -D WORDLIST -t brt
dnsenum --dnsserver TARGET DOMAIN

# Variant — reverse sweep of an explicitly assigned range
dnsrecon -r SUBNET -n TARGET

# Variant — host and Windows nslookup
host -t mx DOMAIN TARGET
host -t txt DOMAIN TARGET

Decisive output: ANSWER records disclose names, addresses, mail exchangers or text. The aa flag supports an authoritative answer. Record status separately from the answer count.

A successful AXFR returns the zone records and closing SOA. Transfer failed, REFUSED or NOTAUTH only disproves an unauthenticated transfer from this source; continue ordinary queries.

Check wildcard behavior before trusting large result sets. Every resolved in-scope name becomes a new discovery/service-enumeration input.

Use this only when the entire SUBNET is assigned. PTR names are clues; resolve/scan only in-scope results.

Host and Windows nslookup

# Variant — host and Windows nslookup
nslookup HOST.DOMAIN TARGET
nslookup -type=TXT HOST.DOMAIN TARGET
nslookup -type=MX DOMAIN TARGET

Verify → Identify responding server, record type, answer and zone authority; transfer refusal disproves only that transfer/context.

If it fails → No answer may mean wrong server, recursion policy, transport or zone. Resolve authoritative context before retrying AXFR. More detail ↓

If → then

No response, a new subnet, or uncertainty about the interface and route → Validate the source path and discover hosts
Needs: Correct VPN/interface and explicit scope; discovery probes must be compatible with the path
DNS names, redirects, certificate names or a default virtual-host response → Discover virtual hosts and hostname-selected applications
Needs: A destination listener, relevant domain candidates and controlled Host/SNI routing
Domain credentials or a domain-joined foothold → Establish domain identity, DC, DNS, time and route
Needs: Correct realm/domain and account qualification; reachable DC/services, usable DNS and acceptable clock skew

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Expand names through DNS records and zone transfers

USE WHEN: A DNS server, domain name or host aliases
STARTING ACCESS: A confirmed reachable application; anonymous context or one identified credential
RESULT: Hostnames, address relationships and possibly a zone inventory

Recognize the clue

Use DNS-server evidence and discovered domain names to query authority and specific records before considering a transfer.

dig @TARGET DOMAIN SOA
dig @TARGET DOMAIN NS
dig @TARGET DOMAIN AXFR

SYNTHETIC EXAMPLE OUTPUT

DOMAIN. SOA DC_HOST. HOSTMASTER.
HOSTNAME.DOMAIN. A TARGET
Transfer completed

Means: An authoritative zone and returned records can expose hostnames, aliases and applications needing separate enumeration.

Confirm: Check each new name's scope/address and verify host/virtual-host behavior.

After validation: A permitted transfer returns a relevant new host: validate it through discovery.
Ruled out in this context: Transfer refused rules out AXFR on this server/zone/context; ordinary records may remain useful.
Still inconclusive: A timeout or non-authoritative response requires authority/transport checks before any zone conclusion.

Troubleshooting: No answer may mean wrong server, recursion policy, transport or zone. Resolve authoritative context before retrying AXFR.

Recognize: DNS uses UDP/53 for most queries and TCP/53 for operations including conventional zone transfers and oversized responses. Prerequisite: a known or inferred domain for meaningful record and name enumeration.

Baseline: query the target DNS server directly

Decisive output: ANSWER records disclose names, addresses, mail exchangers or text. The aa flag supports an authoritative answer. Record status separately from the answer count.

Variant — reverse lookup and zone transfer

A successful AXFR returns the zone records and closing SOA. Transfer failed, REFUSED or NOTAUTH only disproves an unauthenticated transfer from this source; continue ordinary queries.

Variant — name guessing after the domain is known

Check wildcard behavior before trusting large result sets. Every resolved in-scope name becomes a new discovery/service-enumeration input.

Variant — reverse sweep of an explicitly assigned range

Use this only when the entire SUBNET is assigned. PTR names are clues; resolve/scan only in-scope results.

Variant — host and Windows nslookup

Failure cues: NXDOMAIN means that queried name does not exist in that view; NOERROR with no answer can mean the name exists but lacks that record type. Timeout can be filtering, loss or a silent/unreachable server. A recursive answer does not establish that the server is authoritative.

Next action: add new hostnames/IPs to the scoped queue, correlate naming roles with observed services, and repeat discovery/service identification for those in-scope endpoints.

Why it works

A DNS answer belongs to a server and zone context. AXFR exposes zone records only when the server is authoritative and permits the transfer; names become discovery or virtual-host inputs.

Worked example · hypothetical

Observation: the authoritative server permits AXFR. Test: inspect the returned A/CNAME records. Illustrative output: a previously unknown application hostname. Interpretation: confirm scope/address reachability and request that virtual host.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗