loading
Loading content
loading
Attack Surface Management
Query A, AAAA, CNAME, MX, NS, TXT, CAA, and PTR for a host, IP, or CIDR list. Keep resolving names, addresses, and associated hostnames as line lists.
After hostname enumeration, you still need the resource records for the names you collected. Querying A, AAAA, CNAME, MX, NS, TXT, CAA, and PTR for a list of hosts, IPs, or CIDR ranges resolves the names, extracts the addresses, and pulls extra hostnames the records themselves name through PTR, NS, and CNAME chains. It is the resource-record step after subdomain enumeration, not a discovery engine and not a substitute for the network or web tails.
You already have hostnames, IPs, or CIDR ranges. Query DNS resource records for those names: A, AAAA, CNAME, MX, NS, TXT, CAA, and PTR. Keep names that answer, extract the addresses, and pull extra hostnames the records themselves name. This is the resource-record step after hostname enumeration. It is not on the network tail or the web tail, and it does not discover unpublished names. A wildcard A that returns NOERROR is not a live asset. SERVFAIL and REFUSED are signals, not findings.
Pipeline guidance
Do not wire this as a substitute for either tail.
Nest this after hostname enumeration, once you have names, IPs, or ranges to query. If you still need unpublished labels, run an enumerator first. This step queries records for what you already hold.
hosts (FILE). Hostnames, IP addresses, or IP ranges, one per line. There are no optional inputs.
dns-records: JSONL of resource records. Each row is a host, a response code (NOERROR, REFUSED, SERVFAIL), a type (a, aaaa, cname, mx, ns, txt, caa, ptr), a value, and a TTL.
resolving-hostnames and ip-addresses: line lists the next step nests on.
ip-address-details: JSONL that ties each address back to the record that named it (data_source is dns record).
subdomains / subdomain-details: names the records themselves mention (PTR, NS, CNAME). A byproduct, not a second enumerator.
potential-hostnames / potential-hostname-details: related names outside the strict scope you queried. Hints until you resolve them again.
Wildcard lists and their details files: subdomain-wildcards, subdomain-wildcard-details, potential-hostname-wildcards, potential-hostname-wildcard-details. Published outputs. Not CT-log coverage.
The tables this module produces. Sample rows are illustrative.
Resource records (A, AAAA, CNAME, MX, NS, TXT, CAA, PTR) for the hosts you queried.
hosttext | response_codetext | typetext | valuetext | ttlint | |
|---|---|---|---|---|---|
| 1 | www.example.com | NOERROR | a | 203.0.113.10 | 3600 |
| 2 | www.example.com | NOERROR | aaaa | 2001:db8::1 | 3600 |
| 3 | www.example.com | NOERROR | mx | 10 mail.example.com | 1800 |
IP addresses extracted from DNS records, tied back to the record that named them.
ip_addresstext | data_sourcetext | typetext | contexttext | linked_assettext | |
|---|---|---|---|---|---|
| 1 | 203.0.113.10 | dns record | a | A record for www.example.com | www.example.com |
| 2 | 203.0.113.20 | dns record | a | A record for api.example.com | api.example.com |
| 3 | 2001:db8::1 | dns record | aaaa | AAAA record for www.example.com | www.example.com |
Mail servers named in MX records, with the hostnames they associate to.
mail_servertext | associationsjson | associations_countint | initial_assettext | discovery_methodtext | evidencetext | evidence_typetext | |
|---|---|---|---|---|---|---|---|
| 1 | mail.example.com | Array[2] | 2 | example.com | dns record | MX 10 mail.example.com | mx record |
| 2 | mx1.example.net | Array[1] | 1 | example.net | dns record | MX 20 mx1.example.net | mx record |
| 3 | altmail.example.com | Array[1] | 1 | example.com | dns record | MX 30 altmail.example.com | mx record |
Nameservers named in NS records for the queried hosts.
nameservertext | domain_nametext | initial_assettext | discovery_methodtext | evidencetext | evidence_typetext | |
|---|---|---|---|---|---|---|
| 1 | ns1.example.com | example.com | example.com | dns record | NS ns1.example.com | ns record |
| 2 | ns2.example.com | example.com | example.com | dns record | NS ns2.example.com | ns record |
| 3 | ns1.example.net | example.net | example.net | dns record | NS ns1.example.net | ns record |
Enumerate DNS Records
Artifact class it owns
Resource records (A, AAAA, CNAME, MX, NS, TXT, CAA, PTR) for names you hold
Upstream it needs
Hostnames, IPs, or CIDRs you already have
Hostname enumerators (OSINT, crawl, permutations, root DNS, recursive DNS)
Artifact class it owns
Names you did not already have
Upstream it needs
Domains or known hosts
questions
feeds enumerators, not this
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.