{
  "slug": "dns-analysis",
  "title": "DNS Analysis & Zone Enumeration",
  "phase": "Reconnaissance",
  "description": "Analyse DNS records, zone transfers, DNSSEC configuration, and mail infrastructure to uncover hidden services and misconfigurations.",
  "difficulty": "medium",
  "tags": [
    "reconnaissance",
    "dns",
    "zone-transfer",
    "dnssec",
    "mail-security"
  ],
  "tools": [
    "dig",
    "dnsrecon",
    "dnsenum",
    "SecurityTrails",
    "fierce"
  ],
  "steps": [
    {
      "id": "dns-01",
      "title": "Enumerate all DNS record types",
      "description": "Query the target's DNS for A, AAAA, CNAME, MX, TXT, NS, SOA, and SRV records to build a complete picture of the domain's infrastructure.",
      "commands": [
        "dig target.com ANY +noall +answer",
        "dig target.com A AAAA CNAME MX TXT NS SOA SRV +noall +answer",
        "dnsrecon -d target.com -t std"
      ],
      "notes": "The ANY query type is deprecated by many resolvers. Query each record type individually to ensure complete results. TXT records often contain SPF, DKIM, and domain verification tokens that reveal third-party services."
    },
    {
      "id": "dns-02",
      "title": "Attempt zone transfers",
      "description": "Test each authoritative nameserver for misconfigured zone transfers (AXFR) that would disclose the entire DNS zone.",
      "commands": [
        "dig axfr target.com @ns1.target.com",
        "dnsrecon -d target.com -t axfr",
        "dnsenum target.com --noreverse"
      ],
      "notes": "Zone transfers are rarely permitted on modern infrastructure, but they are still worth testing. A successful AXFR is a critical finding that exposes every record in the zone."
    },
    {
      "id": "dns-03",
      "title": "Analyse DNSSEC configuration",
      "description": "Check whether DNSSEC is enabled, properly configured, and whether any signing weaknesses exist that could allow DNS spoofing.",
      "commands": [
        "dig target.com DNSKEY +dnssec +multi",
        "dig target.com DS +trace",
        "delv target.com @8.8.8.8"
      ],
      "notes": "Missing DNSSEC on a high-value domain is a reportable finding for many programmes. If DNSSEC is enabled but misconfigured (expired signatures, missing DS records), it may cause availability issues."
    },
    {
      "id": "dns-04",
      "title": "Review SPF, DKIM, and DMARC records",
      "description": "Evaluate the target's email authentication records to identify spoofing risks and mail infrastructure details.",
      "commands": [
        "dig target.com TXT | grep 'v=spf1'",
        "dig _dmarc.target.com TXT",
        "dig default._domainkey.target.com TXT",
        "nmap --script dns-check-zone -p 53 ns1.target.com"
      ],
      "notes": "A missing or overly permissive SPF record (e.g. +all) allows anyone to send email as the target domain. Missing DMARC with p=none provides no protection even if SPF exists."
    },
    {
      "id": "dns-05",
      "title": "Perform reverse DNS lookups",
      "description": "Resolve IP addresses back to hostnames to discover additional services and virtual hosts sharing the same infrastructure.",
      "commands": [
        "dnsrecon -r 192.168.1.0/24 -n 8.8.8.8",
        "nmap -sL -n 192.168.1.0/24 | awk '/scan report/{print $NF}' | xargs -I{} dig -x {} +short"
      ],
      "notes": "Reverse DNS often reveals internal naming conventions (e.g. mail-prod-01.target.com, db-replica.target.com) that hint at infrastructure you cannot see from forward lookups alone."
    },
    {
      "id": "dns-06",
      "title": "Query DNS history databases",
      "description": "Use SecurityTrails, DNSdumpster, and passive DNS databases to discover historical DNS records, old IP addresses, and decommissioned services.",
      "commands": [
        "curl -s 'https://api.securitytrails.com/v1/history/target.com/dns/a' -H 'APIKEY: YOUR_KEY' | jq '.records[] | {first_seen, last_seen, values}'",
        "fierce --domain target.com"
      ],
      "notes": "Historical DNS data reveals previous hosting providers, old IP addresses that may still respond, and records that were removed but whose infrastructure was never decommissioned."
    },
    {
      "id": "dns-07",
      "title": "Detect cloud providers from DNS",
      "description": "Analyse CNAME chains and IP resolutions to identify which cloud providers and SaaS platforms the target uses.",
      "commands": [
        "dig target.com CNAME +short",
        "dig www.target.com CNAME +trace",
        "for sub in $(cat resolved-subs.txt); do dig $sub CNAME +short; done | sort -u | grep -iE 'aws|azure|gcp|cloudfront|akamai|fastly'"
      ],
      "notes": "CNAME records pointing to cloud services (e.g. d1234.cloudfront.net, target.azurewebsites.net) confirm the cloud provider and may indicate subdomain takeover opportunities if the resource is deprovisioned."
    }
  ],
  "references": [
    "https://github.com/darkoperator/dnsrecon",
    "https://github.com/fwaeytens/dnsenum",
    "https://securitytrails.com",
    "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server",
    "https://portswigger.net/web-security/dns"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}