<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-dns-reconnaissance
description: >-
  Perform DNS reconnaissance including record enumeration, zone transfer
  attempts, reverse DNS lookups, DNS cache snooping, and historical DNS
  analysis to map target infrastructure.
domain: cybersecurity
subdomain: osint-recon
tags:
  - dns
  - reconnaissance
  - zone-transfer
  - reverse-dns
  - dns-history
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  dig, nslookup, dnsx, dnsrecon, fierce, dnspython, massdns,
  SecurityTrails API, PassiveTotal API.
metadata:
  mitre-attack:
    - "T1596.002"  # Search Open Technical Databases: DNS/Passive DNS
    - "T1590.002"  # Gather Victim Network Information: DNS
---

# Conducting DNS Reconnaissance

## Overview

DNS reconnaissance extracts infrastructure intelligence from the Domain Name
System. Techniques include record enumeration (A, AAAA, MX, NS, TXT, SOA,
SRV), zone transfer attempts (AXFR), reverse DNS sweeps, DNS cache snooping,
DNSSEC validation, and historical record analysis via passive DNS databases.

## Prerequisites

- dig, nslookup, host (standard DNS utilities)
- dnsx, dnsrecon, fierce for automated enumeration
- massdns for high-speed bulk resolution
- Python 3.10+ with `dnspython`
- API keys: SecurityTrails, PassiveTotal (optional)

```bash
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest
pip install dnspython requests
```

## Quick Reference

| Task | Command |
|------|---------|
| All records | `dig example.com ANY +noall +answer` |
| MX records | `dig example.com MX +short` |
| TXT / SPF | `dig example.com TXT +short` |
| Zone transfer | `dig @ns1.example.com example.com AXFR` |
| Reverse DNS | `dig -x 1.2.3.4 +short` |
| SOA serial | `dig example.com SOA +short` |
| DNSSEC check | `dig example.com DNSKEY +dnssec` |
| DNS recon tool | `dnsrecon -d example.com -t std,brt,axfr` |
| Cache snoop | `dig @resolver example.com A +norecurse` |
| Bulk resolve | `massdns -r resolvers.txt -t A -o S domains.txt` |

## Workflow

### Step 1: DNS Record Enumeration

```bash
# Comprehensive record query
for TYPE in A AAAA MX NS TXT SOA SRV CNAME CAA; do
  echo "=== $TYPE ===" && dig example.com $TYPE +short
done

# DNSx full recon
dnsx -d example.com -recon -resp -o dns_recon.txt

# Dnsrecon standard enumeration
dnsrecon -d example.com -t std -j dns_results.json
```

### Step 2: Zone Transfer Attempts

```bash
# Get nameservers first
dig example.com NS +short

# Attempt AXFR against each nameserver
for ns in $(dig example.com NS +short); do
  echo "Trying $ns..." && dig @$ns example.com AXFR
done

# DNSx zone transfer
dnsx -d example.com -axfr -resp
```

### Step 3: Reverse DNS Sweeps

```bash
# Reverse lookup a CIDR range
for ip in $(seq 1 254); do
  dig -x 10.0.0.$ip +short
done

# DNSx reverse on CIDR
echo "10.0.0.0/24" | dnsx -silent -resp-only -ptr

# Dnsrecon reverse range
dnsrecon -r 10.0.0.0/24 -t rvl
```

### Step 4: DNS Cache Snooping

```bash
# Non-recursive query — checks if record is cached
dig @target-resolver example.com A +norecurse

# If answer is returned, the resolver has it cached (someone queried it)
```

### Step 5: Historical DNS Analysis

```bash
# SecurityTrails DNS history
curl -s -H "apikey: $ST_KEY" \
  "https://api.securitytrails.com/v1/history/example.com/dns/a" \
  | jq '.records[].values[].ip'

# Check for old IPs that may bypass CDN/WAF
```

### Step 6: SPF, DKIM, DMARC Analysis

```bash
# SPF record
dig example.com TXT +short | grep "v=spf1"

# DKIM (common selectors)
for sel in default google selector1 selector2 k1; do
  dig ${sel}._domainkey.example.com TXT +short
done

# DMARC
dig _dmarc.example.com TXT +short
```

## Detection Opportunities

- Zone transfer attempts logged by authoritative nameservers
- High-volume reverse DNS queries indicate sweep activity
- Unusual record type queries (AXFR, ANY) from external sources
- Passive DNS monitoring detects enumeration patterns

## Verification

- [ ] All standard record types enumerated (A, MX, NS, TXT, SOA)
- [ ] Zone transfer attempted against all nameservers
- [ ] Reverse DNS sweep covers target IP ranges
- [ ] SPF/DKIM/DMARC records analyzed for email security posture
- [ ] Historical DNS checked for infrastructure changes
- [ ] Results cross-referenced with passive DNS sources

## References

- [DNSx](https://github.com/projectdiscovery/dnsx)
- [Dnsrecon](https://github.com/darkoperator/dnsrecon)
- [SecurityTrails API](https://securitytrails.com/corp/apidocs)
- [PassiveTotal](https://community.riskiq.com/registration)

---
v1.0 | Validated: 2026-03-17
