DNS enumeration and reconnaissance

DNS is a hierarchical system used to map names to network information. A recursive resolver answers queries on behalf of clients, while authoritative name servers hold the official records for a DNS zone. During reconnaissance, identifying the authoritative servers is useful because they are the source of truth for that domain.

The most useful records are A for IPv4, AAAA for IPv6, MX for mail servers, NS for authoritative name servers, TXT for verification and service metadata, CNAME for aliases, SOA for zone information and PTR for reverse resolution.

dig can return either full DNS details or a simplified answer. +short is useful when scripting, while +trace shows the delegation path from the root servers to the authoritative server. The @ syntax forces the query to a specific DNS server.

PTR records map an IP address back to a hostname. Reverse DNS can reveal naming information that is not obvious from forward lookups, although it only works when PTR records have been configured.

ANY requests ask a DNS server for multiple record types, but they are not a reliable way to obtain every record in a zone. Modern DNS servers often restrict or minimise ANY responses.

AXFR is a full DNS zone transfer normally used between authorised DNS servers. If a server is misconfigured and allows transfers from arbitrary clients, the response may reveal a large portion of the DNS zone in a single request.

A successful transfer returns multiple zone records instead of an error such as REFUSED or Transfer failed. If a domain has several authoritative name servers, each should be tested individually during an authorised assessment.

Subdomains can expose different applications, environments and services such as dev.sam0x.me, api.sam0x.me or mail.sam0x.me. Known names can be queried directly, while unknown names can be discovered with wordlists.

Some zones resolve any unknown hostname to the same address. This creates false positives during subdomain brute forcing. Test a random name before launching a large wordlist.

dnsenum automates several DNS reconnaissance tasks, including standard record queries, subdomain discovery and reverse lookups.

dig is generally the most detailed tool, but nslookup and host are useful alternatives. nslookup is especially useful on Windows systems where dig may not be installed.

A discovered subdomain may be its own DNS zone. If something like dev.sam0x.me has its own NS or SOA records, treat it as a separate namespace and enumerate it independently.

A useful sequence is to understand authority first, inspect meaningful records, test for zone-transfer exposure, then expand into subdomain discovery. This avoids unnecessary brute forcing and keeps the enumeration structured.

Record newly discovered subdomains, mail infrastructure, unusual TXT records, CNAMEs pointing to third-party services, delegated zones, successful AXFR responses, internal-looking hostnames and IP addresses that expose additional systems.

DNS enumeration should move from structure to discovery: identify who is authoritative, understand the main records, check whether the zone exposes more information than intended, and only then expand into subdomain enumeration.