dns-enmrtn-zone-transfer

Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.

Jump to install

Repository: Undermybelt/hermes-skills
Last source activity: June 7, 2026 at 07:23
Detected SKILL.md language: English
Stars: 6
Forks: 1

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/Undermybelt/hermes-skills --skill dns-enmrtn-zone-transfer

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

4 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

anti-entropy-governance

Use when retiring old logic, collapsing duplicate owners, removing fallbacks, or touching schema, persistence, or source-of-truth boundaries while deciding whether to delete old paths, retain compatibility, or stop for confirmation.

2026-06-07

brainstorming

Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.

2026-06-07

communicating-concisely

Use when the user asks for caveman mode, fewer tokens, brief responses, compressed communication, or otherwise explicitly requests a much shorter answer.

2026-06-07

View all from this repository

name	dns-enmrtn-zone-transfer
description	Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.
domain	cybersecurity
subdomain	network-security
tags	["network-security","dns","enumeration","zone-transfer","reconnaissance"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

Performing DNS Enumeration and Zone Transfer

When to Use

Mapping the external attack surface of a target organization during authorized penetration tests
Discovering hidden subdomains, internal hostnames, and IP addresses exposed via DNS records
Testing whether DNS servers allow unauthorized zone transfers that leak the entire zone file
Identifying mail servers, name servers, and service records for further targeted testing
Validating DNS security configurations including DNSSEC, SPF, DKIM, and DMARC

Do not use against domains you do not have authorization to test, for DNS amplification or reflection attacks, or to overwhelm DNS servers with excessive query volumes.

Prerequisites

Written authorization to perform DNS enumeration against the target domain
DNS enumeration tools installed: dig, nslookup, host, dnsrecon, dnsenum, subfinder, amass
Network access to the target's DNS servers (UDP/TCP port 53)
Wordlist for subdomain brute-forcing (SecLists dns-wordlist or similar)
Understanding of DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA, SRV, PTR)

Workflow

Step 1: Identify DNS Servers and Basic Records

# Find authoritative name servers
dig NS example.com +short
# ns1.example.com.
# ns2.example.com.

# Get SOA record for zone metadata
dig SOA example.com +short
# ns1.example.com. admin.example.com. 2024031501 3600 900 604800 86400

# Enumerate all common record types
dig example.com ANY +noall +answer

# Get MX records (mail servers)
dig MX example.com +short
# 10 mail.example.com.
# 20 mail-backup.example.com.

# Get TXT records (SPF, DKIM, DMARC, verification)
dig TXT example.com +short

# Check for DMARC policy
dig TXT _dmarc.example.com +short

# Check for DKIM selectors
dig TXT default._domainkey.example.com +short
dig TXT selector1._domainkey.example.com +short
dig TXT google._domainkey.example.com +short

# Get SRV records for common services
dig SRV _sip._tcp.example.com +short
dig SRV _ldap._tcp.example.com +short
dig SRV _kerberos._tcp.example.com +short

Step 2: Attempt Zone Transfers


dig AXFR example.com @ns1.example.com
dig AXFR example.com @ns2.example.com


host -t axfr example.com ns1.example.com


dnsrecon -d example.com -t axfr


dig AXFR example.com @ns1.example.com > zone_transfer_results.txt


dig IXFR=2024031500 example.com @ns1.example.com

Term	Definition
Zone Transfer (AXFR)	DNS mechanism that replicates the complete zone file from a primary to secondary server; unauthorized transfers expose all records in the zone
Subdomain Enumeration	Process of discovering valid subdomains through brute force, certificate transparency logs, search engines, and passive DNS databases
DNSSEC	DNS Security Extensions that add cryptographic signatures to DNS responses, preventing cache poisoning and spoofing attacks
SPF/DKIM/DMARC	Email authentication protocols defined in DNS TXT records that prevent email spoofing and domain impersonation
Wildcard DNS	A DNS record using an asterisk (*) that matches any query for non-existent subdomains, potentially masking enumeration results
PTR Record	Reverse DNS record that maps an IP address to a hostname, often revealing internal naming conventions and server roles

dns-enmrtn-zone-transfer

Install options

Review the source files

Performing DNS Enumeration and Zone Transfer

When to Use

Prerequisites

Workflow

Step 1: Identify DNS Servers and Basic Records

Step 2: Attempt Zone Transfers

Performing DNS Enumeration and Zone Transfer

When to Use

Prerequisites

Workflow

Step 1: Identify DNS Servers and Basic Records

Step 2: Attempt Zone Transfers

Step 3: Subdomain Enumeration via Brute Force

Step 4: Reverse DNS and PTR Enumeration

Step 5: Analyze DNS Security Configuration

Step 6: Resolve and Map All Discovered Subdomains

Key Concepts

Tools & Systems

Common Scenarios

Scenario: External Reconnaissance for a Web Application Penetration Test

Output Format

dns-enmrtn-zone-transfer

Source facts

Install options

Review the source files

More from this repository

Performing DNS Enumeration and Zone Transfer

When to Use

Prerequisites

Workflow

Step 1: Identify DNS Servers and Basic Records

Step 2: Attempt Zone Transfers

More from this repository

Performing DNS Enumeration and Zone Transfer

When to Use

Prerequisites

Workflow

Step 1: Identify DNS Servers and Basic Records

Step 2: Attempt Zone Transfers

Step 3: Subdomain Enumeration via Brute Force

Step 4: Reverse DNS and PTR Enumeration

Step 5: Analyze DNS Security Configuration

Step 6: Resolve and Map All Discovered Subdomains

Key Concepts

Tools & Systems

Common Scenarios

Scenario: External Reconnaissance for a Web Application Penetration Test

Output Format