DNS Analysis & Zone Enumeration

Reconnaissance MED v1.0.0 updated 2026-06-17

Analyse DNS records, zone transfers, DNSSEC configuration, and mail infrastructure to uncover hidden services and misconfigurations.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/dns-analysis

// checklist steps

dns-01

Enumerate all DNS record types

Query the target's DNS for A, AAAA, CNAME, MX, TXT, NS, SOA, and SRV records to build a complete picture of the domain's infrastructure.

dig target.com ANY +noall +answer
dig target.com A AAAA CNAME MX TXT NS SOA SRV +noall +answer
dnsrecon -d target.com -t std

The ANY query type is deprecated by many resolvers. Query each record type individually to ensure complete results. TXT records often contain SPF, DKIM, and domain verification tokens that reveal third-party services.

dns-02

Attempt zone transfers

Test each authoritative nameserver for misconfigured zone transfers (AXFR) that would disclose the entire DNS zone.

dig axfr target.com @ns1.target.com
dnsrecon -d target.com -t axfr
dnsenum target.com --noreverse

Zone transfers are rarely permitted on modern infrastructure, but they are still worth testing. A successful AXFR is a critical finding that exposes every record in the zone.

dns-03

Analyse DNSSEC configuration

Check whether DNSSEC is enabled, properly configured, and whether any signing weaknesses exist that could allow DNS spoofing.

dig target.com DNSKEY +dnssec +multi
dig target.com DS +trace
delv target.com @8.8.8.8

Missing DNSSEC on a high-value domain is a reportable finding for many programmes. If DNSSEC is enabled but misconfigured (expired signatures, missing DS records), it may cause availability issues.

dns-04

Review SPF, DKIM, and DMARC records

Evaluate the target's email authentication records to identify spoofing risks and mail infrastructure details.

dig target.com TXT | grep 'v=spf1'
dig _dmarc.target.com TXT
dig default._domainkey.target.com TXT
nmap --script dns-check-zone -p 53 ns1.target.com

A missing or overly permissive SPF record (e.g. +all) allows anyone to send email as the target domain. Missing DMARC with p=none provides no protection even if SPF exists.

dns-05

Perform reverse DNS lookups

Resolve IP addresses back to hostnames to discover additional services and virtual hosts sharing the same infrastructure.

dnsrecon -r 192.168.1.0/24 -n 8.8.8.8
nmap -sL -n 192.168.1.0/24 | awk '/scan report/{print $NF}' | xargs -I{} dig -x {} +short

Reverse DNS often reveals internal naming conventions (e.g. mail-prod-01.target.com, db-replica.target.com) that hint at infrastructure you cannot see from forward lookups alone.

dns-06

Query DNS history databases

Use SecurityTrails, DNSdumpster, and passive DNS databases to discover historical DNS records, old IP addresses, and decommissioned services.

curl -s 'https://api.securitytrails.com/v1/history/target.com/dns/a' -H 'APIKEY: YOUR_KEY' | jq '.records[] | {first_seen, last_seen, values}'
fierce --domain target.com

Historical DNS data reveals previous hosting providers, old IP addresses that may still respond, and records that were removed but whose infrastructure was never decommissioned.

dns-07

Detect cloud providers from DNS

Analyse CNAME chains and IP resolutions to identify which cloud providers and SaaS platforms the target uses.

dig target.com CNAME +short
dig www.target.com CNAME +trace
for sub in $(cat resolved-subs.txt); do dig $sub CNAME +short; done | sort -u | grep -iE 'aws|azure|gcp|cloudfront|akamai|fastly'

CNAME records pointing to cloud services (e.g. d1234.cloudfront.net, target.azurewebsites.net) confirm the cloud provider and may indicate subdomain takeover opportunities if the resource is deprovisioned.

Overview

DNS is the backbone of every internet-facing service. A thorough DNS analysis goes beyond simple record lookups — it maps mail infrastructure, reveals cloud providers, uncovers historical records, and identifies misconfigurations that could lead to domain takeover or email spoofing.

Unlike subdomain enumeration, which focuses on discovering hostnames, DNS analysis examines the configuration and security of the DNS infrastructure itself. Zone transfers, DNSSEC weaknesses, and missing email authentication records are all findings in their own right.

What to look for

Focus on misconfigurations and information leaks:

Successful zone transfers (AXFR) that expose the entire zone
Missing or misconfigured DNSSEC that allows cache poisoning
Permissive SPF records or missing DMARC enforcement
CNAME records pointing to deprovisioned cloud resources
Historical DNS records revealing old infrastructure still online

Mail infrastructure analysis

Email authentication records deserve special attention. A domain without DMARC enforcement (p=reject or p=quarantine) is vulnerable to email spoofing. Many bug bounty programmes accept this as a medium-severity finding, especially for domains used in customer communication.

// references

← All checklists JSON ↗