dns-recon

Perform comprehensive DNS reconnaissance including record enumeration, zone transfers, and reverse lookups. Use when gathering DNS information about a target, when checking for zone transfers, when mapping DNS infrastructure, or when the user asks about DNS records.

Jump to install

Repository: zebbern/termstack
Last source activity: April 10, 2026 at 22:53
Detected SKILL.md language: English
Stars: 5
Forks: 3

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/zebbern/termstack --skill dns-recon

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

2 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

name	dns-recon
description	Perform comprehensive DNS reconnaissance including record enumeration, zone transfers, and reverse lookups. Use when gathering DNS information about a target, when checking for zone transfers, when mapping DNS infrastructure, or when the user asks about DNS records.
tags	["security","dns","reconnaissance","zone-transfer","enumeration"]
triggers	["dns recon","dns enumeration","zone transfer","dns records","dns reconnaissance"]

dns-recon

When to Use

Need to enumerate DNS records for a domain
Checking for DNS zone transfer vulnerabilities (AXFR)
Performing reverse DNS lookups on IP ranges
Validating subdomain lists against DNS
Discovering mail servers, name servers, SOA records
Mapping DNS infrastructure for attack surface
Finding misconfigurations in DNS setup
User asks about DNS records or name servers
DNSSEC zone walking

Quick Start

# Fast DNS resolution with dnsx
echo "example.com" | dnsx -silent -a -resp

# Comprehensive DNS enumeration with dnsrecon
dnsrecon -d example.com -t std

# Manual DNS query with dig
dig example.com ANY +noall +answer

Step-by-Step Process

Phase 1: Fast DNS Resolution (Dnsx)

Resolve hosts from subdomain list:
```
cat subdomains.txt | dnsx -silent
```

Get A records with responses:

cat subdomains.txt | dnsx -silent -a -resp

Get multiple record types:

cat subdomains.txt | dnsx -silent -recon

JSON output:

cat subdomains.txt | dnsx -silent -a -resp -json -o dns_records.json

With custom resolvers:

cat subdomains.txt | dnsx -silent -r resolvers.txt -a -resp

Phase 2: Comprehensive Enumeration (Dnsrecon)

Standard enumeration:
```
dnsrecon -d example.com -t std
```
Zone transfer attempt:
```
dnsrecon -d example.com -t axfr
```
SRV record enumeration:
```
dnsrecon -d example.com -t srv
```
Reverse lookup on range:
```
dnsrecon -r 192.168.1.0/24 -t rvl
```

Brute force with wordlist:

dnsrecon -d example.com -D wordlist.txt -t brt

DNSSEC zone walk:
```
dnsrecon -d example.com -t zonewalk
```

JSON output:

dnsrecon -d example.com -t std -j dns_results.json

Phase 3: Manual Inspection (Dig)

Query all records:
```
dig example.com ANY +noall +answer
```

Specific record types:

dig example.com A +short
dig example.com MX +short
dig example.com NS +short
dig example.com TXT +short
dig example.com SOA +short

Zone transfer attempt:
```
dig @ns1.example.com example.com AXFR
```
Trace DNS resolution:
```
dig example.com +trace
```
Reverse lookup:
```
dig -x 93.184.216.34 +short
```

Phase 4: Combine Results

# Get subdomains
subfinder -d example.com -silent -o subs.txt

# Resolve all with dnsx
cat subs.txt | dnsx -silent -a -resp -json -o dnsx_results.json

# Run dnsrecon for additional info
dnsrecon -d example.com -t std -j dnsrecon_results.json

Examples

Example 1: Basic DNS Resolution

Scenario: Validate subdomain list and get IPs

cat subdomains.txt | dnsx -silent -a -resp

Output:

www.example.com [93.184.216.34]
api.example.com [93.184.216.35]
mail.example.com [93.184.216.36]

Example 2: Zone Transfer Check

Scenario: Test for AXFR vulnerability

dnsrecon -d example.com -t axfr

Output:

[*] Testing NS Servers for Zone Transfer
[*] Checking NS: ns1.example.com
[*] ns1.example.com Is vulnerable to Zone Transfer!
[*] Zone Transfer Success!
[+] NS ns1.example.com
[+] A www.example.com 93.184.216.34
[+] A admin.example.com 93.184.216.40
[+] MX mail.example.com 10

Example 3: Comprehensive Enumeration

Scenario: Full DNS recon on target

dnsrecon -d example.com -t std

Output:

[*] Performing General Enumeration of Domain: example.com
[*] DNSSEC is configured for example.com
[-] All nameservers failed to answer the DNSSEC query
[*] SOA ns1.example.com admin.example.com 2024010101 7200 3600 1209600 86400
[*] NS ns1.example.com 93.184.216.1
[*] NS ns2.example.com 93.184.216.2
[*] MX mail.example.com 10
[*] A example.com 93.184.216.34
[*] AAAA example.com 2606:2800:220:1:248:1893:25c8:1946
[*] TXT "v=spf1 include:_spf.example.com ~all"

Example 4: Extract CNAME Records

Scenario: Find CNAMEs for takeover candidates

cat subdomains.txt | dnsx -silent -cname -resp

Output:

support.example.com [hackerone.zendesk.com]
docs.example.com [example.github.io]
status.example.com [statuspage.io]

Example 5: Reverse DNS on IP Range

Scenario: Find hostnames from IP range

dnsrecon -r 192.168.1.0/24 -t rvl

Output:

[*] Reverse Look-up of a Range
[*] Performing Reverse Lookup from 192.168.1.0 to 192.168.1.255
[+] PTR router.local 192.168.1.1
[+] PTR server1.local 192.168.1.10
[+] PTR printer.local 192.168.1.50

Example 6: PTR from ASN

Scenario: Discover domains from ASN

echo AS17012 | dnsx -silent -resp-only -ptr

Output:

api.paypal.com
www.paypal.com
notify.paypal.com

Example 7: SRV Record Discovery

Scenario: Find service records

dnsrecon -d example.com -t srv

Output:

[*] Enumerating SRV Records
[+] SRV _sip._tcp.example.com sip.example.com 5060 10
[+] SRV _xmpp._tcp.example.com xmpp.example.com 5222 10
[+] SRV _ldap._tcp.example.com ldap.example.com 389 10

Example 8: Full Recon Pipeline

Scenario: Complete DNS reconnaissance

TARGET="example.com"
mkdir -p recon/$TARGET/dns

# Get nameservers
dig $TARGET NS +short > recon/$TARGET/dns/nameservers.txt

# Zone transfer attempt
dnsrecon -d $TARGET -t axfr -j recon/$TARGET/dns/axfr.json

# Standard enumeration
dnsrecon -d $TARGET -t std -j recon/$TARGET/dns/std.json

# Resolve subdomains
subfinder -d $TARGET -silent | dnsx -silent -a -resp -json -o recon/$TARGET/dns/resolved.json

# Summary
echo "DNS Recon Complete for $TARGET"
cat recon/$TARGET/dns/nameservers.txt

Error Handling

Error	Cause	Resolution
`no results found`	No DNS response	Check domain exists
`SERVFAIL`	Server failure	Try different resolver
`NXDOMAIN`	Domain doesn't exist	Verify domain spelling
`REFUSED`	Query refused	Use different DNS server
`timeout`	No response	Increase timeout, check connectivity
`transfer failed`	AXFR not allowed	Zone transfer disabled (normal)
`could not resolve`	DNS error	Check network, try custom resolver

Tool Reference

Dnsx Flags

Flag	Description
`-l, -list`	Input file with hosts
`-d, -domain`	Domain for bruteforce
`-w, -wordlist`	Wordlist for bruteforce
`-a`	Query A records (default)
`-aaaa`	Query AAAA records
`-cname`	Query CNAME records
`-ns`	Query NS records
`-txt`	Query TXT records
`-mx`	Query MX records
`-soa`	Query SOA records
`-ptr`	Query PTR records
`-srv`	Query SRV records
`-axfr`	Query AXFR
`-caa`	Query CAA records
`-recon`	Query all record types
`-resp`	Display DNS response
`-resp-only`	Response only (no hostname)
`-json`	JSON output
`-o, -output`	Output file
`-silent`	Clean output
`-r, -resolver`	Custom resolvers
`-t, -threads`	Thread count (default 100)
`-rl, -rate-limit`	Rate limit
`-asn`	Display ASN info
`-cdn`	Display CDN info
`-wd, -wildcard-domain`	Wildcard filtering

Dnsrecon Flags

Flag	Description
`-d, --domain`	Target domain
`-n, --name_server`	Custom DNS server
`-r, --range`	IP range for reverse lookup
`-D, --dictionary`	Wordlist for bruteforce
`-t, --type`	Enumeration type
`-a`	Perform AXFR with std
`-s`	SPF record reverse lookup
`-k`	crt.sh enumeration
`-w`	Deep whois analysis
`-z`	DNSSEC zone walk
`-j, --json`	JSON output file
`-x, --xml`	XML output file
`-c, --csv`	CSV output file
`--threads`	Thread count
`--lifetime`	Query timeout
`-v, --verbose`	Verbose output

Dnsrecon Types (-t)

Type	Description
`std`	Standard enumeration (SOA, NS, A, AAAA, MX, SRV)
`axfr`	Zone transfer test
`brt`	Brute force with dictionary
`srv`	SRV record enumeration
`rvl`	Reverse lookup on range
`crt`	crt.sh certificate search
`tld`	TLD expansion
`zonewalk`	DNSSEC zone walk
`snoop`	Cache snooping

Dig Flags

Flag	Description
`@server`	Specify DNS server
`+short`	Short output
`+noall +answer`	Only answer section
`+trace`	Trace resolution path
`-x IP`	Reverse lookup
`AXFR`	Zone transfer request
`ANY`	All record types

Output Interpretation

DNS Record Types

Type	Description	Security Relevance
A	IPv4 address	Target IPs
AAAA	IPv6 address	IPv6 targets
CNAME	Canonical name	Subdomain takeover
MX	Mail exchange	Email security
NS	Name server	DNS infrastructure
TXT	Text records	SPF, DKIM, secrets
SOA	Start of authority	Zone admin info
SRV	Service records	Internal services
PTR	Pointer (reverse)	Hostname discovery
CAA	Cert authority	SSL/TLS policy

Dnsx JSON Output

{
  "host": "www.example.com",
  "resolver": ["8.8.8.8:53"],
  "a": ["93.184.216.34"],
  "aaaa": ["2606:2800:220:1:248:1893:25c8:1946"],
  "cname": [],
  "status_code": "NOERROR"
}

Common TXT Records

v=spf1 (SPF), v=DKIM1 (DKIM), _dmarc (DMARC), google-site-verification, MS= (Microsoft)

Advanced Techniques

Wildcard Detection

# Check for wildcard
dig randomnonexistent12345.example.com A +short

# Filter wildcards with dnsx
dnsx -l subdomains.txt -wd example.com -o filtered.txt

Custom Resolvers

# Create resolver list
echo "8.8.8.8" > resolvers.txt
echo "1.1.1.1" >> resolvers.txt

# Use with dnsx
cat subs.txt | dnsx -r resolvers.txt -silent -a -resp

Best Practices

Start with dnsx - Fast validation of subdomains
Run dnsrecon std - Comprehensive record enumeration
Check zone transfers - AXFR vulnerability test
Extract CNAMEs - Subdomain takeover candidates
Manual dig - Detailed inspection of interesting records

Use dnsx for bulk resolution (faster), dnsrecon for comprehensive enumeration. Set rate limits when scanning large lists. Use custom resolvers for reliability. Filter wildcards before processing results.

Integration Examples

Pipe to Subdomain Takeover Check

# Find dangling CNAMEs
cat subs.txt | dnsx -silent -cname -resp | grep -i "github\|herokuapp\|s3\|azure"

Pipe to Httpx

# Resolve and probe
cat subs.txt | dnsx -silent | httpx -silent -sc -title

Export for Reporting

# CSV export
dnsrecon -d example.com -t std -c dns_report.csv

# JSON processing
cat dnsx_results.json | jq -r '[.host, (.a | join(","))] | @csv'

References

Dnsx | Dnsrecon | Dig Manual

dns-recon

Source facts

Install options

Review the source files

More from this repository

dns-recon

When to Use

Quick Start

Step-by-Step Process

Phase 1: Fast DNS Resolution (Dnsx)

Phase 2: Comprehensive Enumeration (Dnsrecon)

Phase 3: Manual Inspection (Dig)

Phase 4: Combine Results

Examples

Example 1: Basic DNS Resolution

Example 2: Zone Transfer Check

Example 3: Comprehensive Enumeration

Example 4: Extract CNAME Records

Example 5: Reverse DNS on IP Range

Example 6: PTR from ASN

Example 7: SRV Record Discovery

Example 8: Full Recon Pipeline

Error Handling

Tool Reference

Dnsx Flags

Dnsrecon Flags

Dnsrecon Types (-t)

Dig Flags

Output Interpretation

DNS Record Types

Dnsx JSON Output

Common TXT Records

Advanced Techniques

Wildcard Detection

Custom Resolvers

Best Practices

Integration Examples

Pipe to Subdomain Takeover Check

Pipe to Httpx

Export for Reporting

References

dns-recon

When to Use

Quick Start

Step-by-Step Process

Phase 1: Fast DNS Resolution (Dnsx)

Phase 2: Comprehensive Enumeration (Dnsrecon)

Phase 3: Manual Inspection (Dig)

Phase 4: Combine Results

Examples

Example 1: Basic DNS Resolution

Example 2: Zone Transfer Check

Example 3: Comprehensive Enumeration

Example 4: Extract CNAME Records

Example 5: Reverse DNS on IP Range

Example 6: PTR from ASN

Example 7: SRV Record Discovery

Example 8: Full Recon Pipeline

Error Handling

Tool Reference

Dnsx Flags

Dnsrecon Flags

Dnsrecon Types (-t)

Dig Flags

Output Interpretation

DNS Record Types

Dnsx JSON Output

Common TXT Records

Advanced Techniques

Wildcard Detection

Custom Resolvers

Best Practices

Integration Examples

Pipe to Subdomain Takeover Check

Pipe to Httpx

Export for Reporting

References

More from this repository