dns-enmrtn-zone-transfer

name	dns-enmrtn-zone-transfer
description	Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.
domain	cybersecurity
subdomain	network-security
tags	["network-security","dns","enumeration","zone-transfer","reconnaissance"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

Performing DNS Enumeration and Zone Transfer

When to Use

• Mapping the external attack surface of a target organization during authorized penetration tests
• Discovering hidden subdomains, internal hostnames, and IP addresses exposed via DNS records
• Testing whether DNS servers allow unauthorized zone transfers that leak the entire zone file
• Identifying mail servers, name servers, and service records for further targeted testing
• Validating DNS security configurations including DNSSEC, SPF, DKIM, and DMARC

Do not use against domains you do not have authorization to test, for DNS amplification or reflection attacks, or to overwhelm DNS servers with excessive query volumes.

Prerequisites

• Written authorization to perform DNS enumeration against the target domain
• DNS enumeration tools installed: dig, nslookup, host, dnsrecon, dnsenum, subfinder, amass
• Network access to the target's DNS servers (UDP/TCP port 53)
• Wordlist for subdomain brute-forcing (SecLists dns-wordlist or similar)
• Understanding of DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA, SRV, PTR)

Workflow

Step 1: Identify DNS Servers and Basic Records

# Find authoritative name servers
dig NS example.com +short
# ns1.example.com.
# ns2.example.com.

# Get SOA record for zone metadata
dig SOA example.com +short
# ns1.example.com. admin.example.com. 2024031501 3600 900 604800 86400

# Enumerate all common record types
dig example.com ANY +noall +answer

# Get MX records (mail servers)
dig MX example.com +short
# 10 mail.example.com.
# 20 mail-backup.example.com.

# Get TXT records (SPF, DKIM, DMARC, verification)
dig TXT example.com +short

# Check for DMARC policy
dig TXT _dmarc.example.com +short

# Check for DKIM selectors
dig TXT default._domainkey.example.com +short
dig TXT selector1._domainkey.example.com +short
dig TXT google._domainkey.example.com +short

# Get SRV records for common services
dig SRV _sip._tcp.example.com +short
dig SRV _ldap._tcp.example.com +short
dig SRV _kerberos._tcp.example.com +short

Step 2: Attempt Zone Transfers

dig AXFR example.com @ns1.example.com
dig AXFR example.com @ns2.example.com


host -t axfr example.com ns1.example.com


dnsrecon -d example.com -t axfr


dig AXFR example.com @ns1.example.com > zone_transfer_results.txt


dig IXFR=2024031500 example.com @ns1.example.com