---
title: "DNS Enumeration"
canonical: https://trickest.com/glossary/dns-enumeration
description: "DNS enumeration queries a domain's DNS records (A, MX, TXT, NS, and others) and attempts zone transfers to reveal hosts, mail servers, and infrastructure clues."
---

# DNS Enumeration

DNS enumeration pulls the records a domain publishes to build a picture of its infrastructure. A records and AAAA records map names to IP addresses, MX records reveal mail providers, NS records show which servers are authoritative, and TXT records often leak SPF entries, verification tokens, and the names of SaaS vendors a company uses. A misconfigured server may even allow a full zone transfer (AXFR), handing over every record in one request.

In discovery this is one of the first steps because it costs little and exposes a lot. The records point to cloud regions, third-party services, and naming conventions that guide deeper probing, and the IPs anchor later port scanning. DNS enumeration sits next to [subdomain enumeration](/glossary/subdomain-enumeration) in the early [discovery](/glossary/recon) phase, and pairs with [passive DNS](/glossary/passive-dns) data to recover records that no longer resolve but still reveal past infrastructure.

Watch the line between active and passive collection. Direct queries and zone-transfer attempts touch the target's servers, while passive sources keep you off them entirely.

In a Trickest workflow you query record types in parallel across a domain list, fold in passive sources, and diff results over time so new mail providers or staging hosts surface as soon as the records change.

---
_Markdown source of https://trickest.com/glossary/dns-enumeration._