How is this different from the hostname enumerators?

They discover names. You query resource records for names you already have. Run an enumerator first, then this, then a tail.

What record types does it return?

A, AAAA, CNAME, MX, NS, TXT, CAA, and PTR. SOA and SRV are not in that list. AXFR is off.

Does it find subdomains?

Only as a byproduct. PTR, NS, and CNAME records name other hosts, which land in `subdomains`. That is not a second discovery engine. For discovery, run a hostname enumerator.

What are `potential-hostnames` here?

Related hostnames the records name through CNAME, NS, or PTR, outside the strict scope you queried. They are hints, not confirmed assets. Resolve them again before you scan.

2026-08-13

Attack Surface Management

Enumerate DNS Records

Query A, AAAA, CNAME, MX, NS, TXT, CAA, and PTR for a host, IP, or CIDR list. Keep resolving names, addresses, and associated hostnames as line lists.

What Enumerate DNS Records does

After hostname enumeration, you still need the resource records for the names you collected. Querying A, AAAA, CNAME, MX, NS, TXT, CAA, and PTR for a list of hosts, IPs, or CIDR ranges resolves the names, extracts the addresses, and pulls extra hostnames the records themselves name through PTR, NS, and CNAME chains. It is the resource-record step after subdomain enumeration, not a discovery engine and not a substitute for the network or web tails.

You already have hostnames, IPs, or CIDR ranges. Query DNS resource records for those names: A, AAAA, CNAME, MX, NS, TXT, CAA, and PTR. Keep names that answer, extract the addresses, and pull extra hostnames the records themselves name. This is the resource-record step after hostname enumeration. It is not on the network tail or the web tail, and it does not discover unpublished names. A wildcard A that returns NOERROR is not a live asset. SERVFAIL and REFUSED are signals, not findings.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Pipeline guidance

Upstream: any of the five hostname enumerators, or a static host / IP / CIDR list. The wordlist feeder does not feed this; it feeds brute-force enumerators.
Downstream: Probe for Web Servers and Scan for Open Ports consume resolving hostnames and IP addresses. This step feeds both tails. It sits on neither.
Parallel: none with this face. Enumerators run before this. The tails run after.

Do not wire this as a substitute for either tail.

When to use this

Nest this after hostname enumeration, once you have names, IPs, or ranges to query. If you still need unpublished labels, run an enumerator first. This step queries records for what you already hold.

Inputs and outputs

Required: hosts (FILE). Hostnames, IP addresses, or IP ranges, one per line. There are no optional inputs.
Outputs: dns-records: JSONL of resource records. Each row is a host, a response code (NOERROR, REFUSED, SERVFAIL), a type (a, aaaa, cname, mx, ns, txt, caa, ptr), a value, and a TTL.
resolving-hostnames and ip-addresses: line lists the next step nests on.
ip-address-details: JSONL that ties each address back to the record that named it (data_source is dns record).
subdomains / subdomain-details: names the records themselves mention (PTR, NS, CNAME). A byproduct, not a second enumerator.
potential-hostnames / potential-hostname-details: related names outside the strict scope you queried. Hints until you resolve them again.
Wildcard lists and their details files: subdomain-wildcards, subdomain-wildcard-details, potential-hostname-wildcards, potential-hostname-wildcard-details. Published outputs. Not CT-log coverage.

Data

The tables this module produces. Sample rows are illustrative.

dns-records5 columns · 3 sample rows

Resource records (A, AAAA, CNAME, MX, NS, TXT, CAA, PTR) for the hosts you queried.

	hosttext	response_codetext	typetext	valuetext	ttlint
1	www.example.com	NOERROR	a	203.0.113.10	3600
2	www.example.com	NOERROR	aaaa	2001:db8::1	3600
3	www.example.com	NOERROR	mx	10 mail.example.com	1800

ip-addresses5 columns · 3 sample rows

IP addresses extracted from DNS records, tied back to the record that named them.

	ip_addresstext	data_sourcetext	typetext	contexttext	linked_assettext
1	203.0.113.10	dns record	a	A record for www.example.com	www.example.com
2	203.0.113.20	dns record	a	A record for api.example.com	api.example.com
3	2001:db8::1	dns record	aaaa	AAAA record for www.example.com	www.example.com

mail-servers7 columns · 3 sample rows

Mail servers named in MX records, with the hostnames they associate to.

	mail_servertext	associationsjson	associations_countint	initial_assettext	discovery_methodtext	evidencetext	evidence_typetext
1	mail.example.com	Array[2]	2	example.com	dns record	MX 10 mail.example.com	mx record
2	mx1.example.net	Array[1]	1	example.net	dns record	MX 20 mx1.example.net	mx record
3	altmail.example.com	Array[1]	1	example.com	dns record	MX 30 altmail.example.com	mx record

nameservers6 columns · 3 sample rows

Nameservers named in NS records for the queried hosts.

	nameservertext	domain_nametext	initial_assettext	discovery_methodtext	evidencetext	evidence_typetext
1	ns1.example.com	example.com	example.com	dns record	NS ns1.example.com	ns record
2	ns2.example.com	example.com	example.com	dns record	NS ns2.example.com	ns record
3	ns1.example.net	example.net	example.net	dns record	NS ns1.example.net	ns record

How it differs from similar modules

Enumerate DNS Records

Artifact class it owns

Resource records (A, AAAA, CNAME, MX, NS, TXT, CAA, PTR) for names you hold

Upstream it needs

Hostnames, IPs, or CIDRs you already have

Hostname enumerators (OSINT, crawl, permutations, root DNS, recursive DNS)

Artifact class it owns

Names you did not already have

Upstream it needs

Domains or known hosts

Scan for Open Ports

Artifact class it owns

Open TCP ports

Upstream it needs

Hosts

questions