| name | recon-dns-analysis |
| description | Deep DNS analysis for attack surface — record mining, zone transfers, DNSSEC/NSEC walking, and dangling records. Load during recon, on "DNS", a domain in scope, or hunting takeovers/origin IPs. Signals: a root domain, CNAMEs, MX/TXT/SPF, NS servers, subdomains to resolve.
|
| domain | recon |
| type | technique |
| stability | learning |
| modes | ["bugbounty","pentest"] |
| severity | info |
| mitre | ["T1590.002"] |
| tools | ["dig","dnsx","dnsrecon","fierce"] |
| schema_version | 1 |
DNS analysis
When it applies
Early recon and anytime you want surface/intel from DNS: subdomains, mail/infra hints, cloud
providers, dangling records (takeover leads), and origin IPs hiding behind a CDN.
Why it works
DNS is a public map of an org's infrastructure. Records leak providers (CNAME → SaaS), mail and
SPF/DMARC hosts, and misconfigurations (open zone transfer dumps everything; NSEC lets you walk a
DNSSEC zone). Stale records point at deprovisioned services (→ takeover).
Method
- Enumerate records:
dig ANY domain, plus explicit A AAAA CNAME MX TXT NS SOA — TXT/SPF
reveal third parties; MX reveals mail infra.
- Zone transfer (rare but total): find NS (
dig NS domain), then dig axfr @ns1 domain —
a successful AXFR dumps every record.
- DNSSEC walking: if NSEC is used, walk the chain to enumerate names (
dnsrecon -t zonewalk).
- Dangling / takeover leads: resolve CNAMEs; ones pointing at unclaimed SaaS →
web-subdomain-takeover.
- Origin discovery: historical DNS (SecurityTrails), SPF-listed IPs, and cert SANs can reveal
the real origin behind a CDN (bypass the WAF later).
Gotchas
- AXFR is usually refused — but when it works it's the whole zone; always try the NS servers.
- CDN/proxied records hide the origin; pivot to cert/historical data, not the proxied A record.
- Wildcard DNS inflates brute-force — detect and filter it (
dnsx wildcard handling).
Verify success
A richer map: resolvable subdomains, provider/infra hints, any AXFR/NSEC dump, and takeover or
origin-IP leads to hand to the next skill.
References
dig/dnsrecon docs; SecurityTrails; OWASP Amass; can-i-take-over-xyz.
