<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: writing-dns-enumeration-templates
description: >-
  Write Nuclei DNS protocol templates for subdomain enumeration, DNS
  record analysis, zone transfer detection, dangling CNAME discovery,
  and DNS-based service fingerprinting. Covers A, AAAA, CNAME, MX, TXT,
  NS, SOA, and SRV record querying with matcher chains.
domain: cybersecurity
subdomain: nuclei-templating
tags:
  - nuclei
  - dns
  - enumeration
  - subdomain
  - reconnaissance
  - templates
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1590.002"]
---

# Writing DNS Enumeration Templates

## Overview

DNS enumeration templates use Nuclei's DNS protocol to query authoritative
nameservers and analyze records for misconfigurations, subdomain takeover
opportunities, and information disclosure. They operate at the DNS layer,
not HTTP, enabling reconnaissance against infrastructure that has no web
presence. Good DNS templates combine record type queries with response
analysis to identify dangling CNAMEs, open zone transfers, and SPF/DMARC
weaknesses.

Mode: `[MODE: RECON]` — DNS-layer reconnaissance and enumeration.

## Prerequisites

| Requirement | Details |
|---|---|
| Nuclei v3+ (`nuclei -version`) | Required |
| Understanding of DNS record types and resolution | Required |
| Target domains for enumeration | Required |

## Key Concepts

### Zone Transfer Detection

```yaml
id: dns-zone-transfer

info:
  name: DNS Zone Transfer (AXFR) Detection
  author: nerf
  severity: high
  description: |
    Detects DNS servers that allow unauthorized zone transfers. AXFR
    responses reveal the complete DNS zone including all subdomains,
    internal hostnames, and service records.
  classification:
    cwe-id: CWE-200
  tags: dns,zone-transfer,axfr,misconfig
  metadata:
    max-request: 1

dns:
  - name: "{{FQDN}}"
    type: AXFR
    matchers:
      - type: word
        words:
          - "IN\tA"
          - "IN\tAAAA"
          - "IN\tCNAME"
        condition: or
    extractors:
      - type: regex
        regex:
          - '([a-zA-Z0-9._-]+)\.\s+\d+\s+IN\s+A\s+(\d+\.\d+\.\d+\.\d+)'
```

### Dangling CNAME — Subdomain Takeover

```yaml
id: dangling-cname-detection

info:
  name: Dangling CNAME Record — Subdomain Takeover
  author: nerf
  severity: high
  description: |
    Detects CNAME records pointing to external services that no longer
    exist. These dangling CNAMEs are vulnerable to subdomain takeover
    where an attacker claims the target service and serves content.
  classification:
    cwe-id: CWE-672
  tags: dns,cname,takeover,subdomain
  metadata:
    max-request: 1

dns:
  - name: "{{FQDN}}"
    type: CNAME
    matchers-condition: or
    matchers:
      - type: word
        words:
          - ".amazonaws.com"
          - ".azurewebsites.net"
          - ".cloudfront.net"
          - ".github.io"
          - ".herokuapp.com"
          - ".s3.amazonaws.com"
          - ".trafficmanager.net"
        condition: or
    extractors:
      - type: regex
        regex:
          - 'IN\s+CNAME\s+(.+)\.'
```

### SPF Record Misconfiguration

```yaml
id: spf-record-misconfiguration

info:
  name: SPF Record Misconfiguration Detection
  author: nerf
  severity: medium
  description: |
    Detects weak or missing SPF records that could allow email spoofing.
    Checks for overly permissive +all directives, missing SPF records,
    and configurations that exceed the 10-lookup limit.
  classification:
    cwe-id: CWE-290
  tags: dns,spf,email,misconfig
  metadata:
    max-request: 1

dns:
  - name: "{{FQDN}}"
    type: TXT
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "v=spf1"
          - "+all"
        condition: and
      - type: regex
        regex:
          - '^(?!.*v=spf1)'
    extractors:
      - type: regex
        regex:
          - '(v=spf1[^"]*)'
```

### DMARC Policy Detection

```yaml
id: dmarc-policy-detection

info:
  name: DMARC Policy Detection and Analysis
  author: nerf
  severity: info
  description: |
    Queries DMARC DNS records to evaluate email authentication policy.
    Identifies missing DMARC, permissive policies (p=none without rua),
    and subdomain policy gaps.
  tags: dns,dmarc,email,policy
  metadata:
    max-request: 1

dns:
  - name: "_dmarc.{{FQDN}}"
    type: TXT
    matchers:
      - type: word
        words:
          - "v=DMARC1"
    extractors:
      - type: regex
        regex:
          - '(v=DMARC1[^"]*)'
```

### MX Record Enumeration

```yaml
id: mx-record-enumeration

info:
  name: MX Record Enumeration
  author: nerf
  severity: info
  description: |
    Enumerates mail exchange records to identify email infrastructure,
    provider services, and potential mail relay targets.
  tags: dns,mx,email,recon
  metadata:
    max-request: 1

dns:
  - name: "{{FQDN}}"
    type: MX
    matchers:
      - type: regex
        regex:
          - 'IN\s+MX'
    extractors:
      - type: regex
        regex:
          - '\d+\s+(\S+)\.'
```

## Workflow

### Step 1: Validate Template

```bash
nuclei -t dns-template.yaml -validate
```

### Step 2: Run DNS Enumeration

```bash
node scripts/agent.js --action scan --target example.com \
  --template dns-template.yaml --output /tmp/dns-scan.json
```

### Step 3: Bulk Domain Scan

```bash
node scripts/agent.js --action scan --target-list domains.txt \
  --template dns-templates/ --output /tmp/dns-bulk.json
```

## Verification

- [ ] Templates use `dns:` protocol block, not `http:`
- [ ] Correct DNS record type specified (A, CNAME, TXT, MX, AXFR)
- [ ] `{{FQDN}}` variable used for target domain
- [ ] Extractors capture relevant DNS response data
- [ ] Dangling CNAME templates list current cloud provider suffixes
- [ ] SPF/DMARC templates handle missing records
- [ ] `max-request` metadata matches actual query count

## References

- [Nuclei DNS Protocol](https://docs.projectdiscovery.io/templates/protocols/dns)
- [DNS Record Types](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml)
- [Subdomain Takeover — Can I Take Over XYZ](https://github.com/EdOverflow/can-i-take-over-xyz)
- [SPF Record Syntax](https://www.openspf.org/SPF_Record_Syntax)
