DNS Enumeration

Last Updated : 8 Jun, 2026

DNS Enumeration is the process of discovering and mapping DNS records of a domain to understand its publicly exposed infrastructure. It helps identify subdomains, servers and network endpoints, providing valuable insight during security assessments and reconnaissance.

  • Maps DNS records to reveal an organization’s online footprint
  • Identifies subdomains, mail servers and exposed assets
  • Used in penetration testing and OSINT investigations
  • Detects misconfigurations like open zone transfers (AXFR)
  • Supports attack surface discovery and analysis
dns_records

Example: A user enters  www.geeksforgeeks.org  in a browser, now the DNS will intercept this request and will fetch the corresponding IP address and connect the user to that IP address.

DNS Enumeration Techniques and Process

There are various tools to do DNS Enumeration, you are free to explore them by doing a simple web search about DNS Enumeration tools, but here we are going to use Nmap as an example:-

1. Passive reconnaissance (start here)

Passive reconnaissance is performed without directly interacting with the target DNS servers. It helps gather preliminary information safely.

  • Uses Certificate Transparency logs (e.g., crt.sh) to find issued certificates and subdomains
  • Uses OSINT sources such as SecurityTrails, Censys and archived web data
  • Searches engines and public subdomain lists to identify possible targets
  • Helps map the attack surface without alerting the target

2. Basic Active Queries (dig and host)

Active DNS queries are used to directly interact with DNS servers and retrieve record information.

  • Tools like dig and host are used for fast and accurate DNS lookups

Example command:

dig +nocmd example.com A +noall +answer
1

Can also query different record types such as:

  • A (IPv4 addresses)
  • AAAA (IPv6 addresses)
  • MX (mail servers)
  • NS (name servers)
  • TXT (text records)

3. Zone Transfer Attempt (AXFR)

Zone transfer is used to retrieve the entire DNS zone file if misconfigured.

  • If allowed, it reveals all DNS records of a domain

Example command:

dig @ns1.example.com example.com AXFR
  • A successful AXFR may expose sensitive internal infrastructure details

4. Nmap DNS Scripts

Nmap is a powerful network scanning tool that includes built-in scripts for DNS enumeration. It can be used to discover DNS-related information from a target system.

Example command:

nmap -sSU -p 53 --script dns-nsec-enum --script-args dns-nsec-enum.domains=example.com <target>

Common DNS Scripts:

  • dns-brute.nse: Performs brute-force attacks to discover subdomains
  • dns-cache-snoop.nse: Checks DNS cache entries to gather information
  • dns-check-zone.nse: Validates DNS zone configuration and records

 Output:

Enumeration through Nmap

Note: If no NSEC records are found, other scripts like dns-brute.nse or dns-cache-snoop.nse can be used for deeper enumeration.

5. Amass (Subdomain Discovery Tool)

  • A widely used tool for passive and active subdomain enumeration
  • Collects data from multiple sources using OSINT techniques
  • Helps map the full attack surface of a domain
  • Commonly used in cybersecurity and penetration testing

Example:

amass enum -passive -d example.com

6. Subdomain Brute Force and Resolution

  • Used to discover hidden or unlisted subdomains (e.g., dev, test, staging)
  • Helps identify forgotten or misconfigured services

Example Command:

amass enum -passive -d www.example.com

Output:

1

7. Reverse DNS (PTR Enumeration)

  • Maps IP addresses back to domain names
  • Useful for discovering hidden hosts in a network

Example:

for ip in $(prips 10.0.0.0/24); do dig -x $ip +short; done

8. DNS Record Analysis (TXT Records)

  • TXT records may contain sensitive information like: SPF and DKIM settings, Domain verification tokens, Third-party service configurations
  • Useful for identifying possible information leakage

Prevention

  • Restrict AXFR: allow zone transfers only to trusted management IPs; deny to the public.
  • Separate internal/external zones: do not publish internal hostnames or IPs in public DNS. Use split-horizon DNS or internal-only zones.
  • Proper TXT hygiene: avoid embedding secrets, tokens or credentials in TXT records.
  • Rate limit and monitor: log and alert on unusual DNS query patterns (possible reconnaissance).
  • TTL strategy: set sensible TTLs and remove stale records promptly.
  • DNS provider features: use managed DNS features (access control, role separation) and avoid exposing management APIs.
  • Audit regularly: automated scans and periodic manual reviews to find accidentally published records.
  • DNSSEC caution: DNSSEC protects integrity but NSEC records can enable zone walking review DNSSEC configuration and consider NSEC3 with salt if appropriate.
Comment

Explore