loading
Loading content
loading
OSINT
Passive DNS records from DNSDumpster.
overview
Feed a root domain; the node queries DNSDumpster and writes host (A) records with IPs, name servers, mail servers, and TXT data to a file and folder for downstream steps.
Reach for it at the start of recon when you want a quiet DNS map before any active resolution or HTTP probing. Nothing is sent to the target's name servers.
Compared with dnsx or dnsrecon, this stays passive. Use dnsdumpster-host-search for a host-centric query on the same service. Pass returned hostnames to httpx or dnsx to verify what is live.
use cases
Pull a domain's hosts, name servers, and mail records from DNSDumpster to scope an engagement without sending traffic to the target.
Capture the DNS records tied to a root domain as a starting inventory the rest of the workflow expands and verifies.
Read the MX, NS, and TXT records to see how a domain routes mail and delegates DNS before you probe any host.
Hand the returned hostnames to httpx or dnsx so the workflow continues from a passively gathered seed set.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Root domain to enumerate (passed as the node's single input). |
Showing key inputs. dnsdumpster-dns-lookup exposes 1 inputs in total.
example
# passive DNS records for a domain via DNSDumpsterdnsdumpster-dns-lookup example.comHost Records (A)example.com 203.0.113.10 HTTP: nginx AS64500 Example Cloudwww.example.com 203.0.113.11 HTTP: nginx AS64500 Example Cloudmail.example.com 203.0.113.25 SMTP AS64500 Example CloudDNS Serversns1.example.com 198.51.100.53 AS64500 Example Cloudns2.example.com 198.51.100.54 AS64500 Example CloudMX Records10 mail.example.comTXT: v=spf1 include:_spf.example.com ~allguidance
Use DNSDumpster DNS Lookup at the start of recon when you want DNS records for a domain without querying it directly. For a host-centric search on the same service, use dnsdumpster-host-search. To actively resolve records yourself, use dnsx or dnsrecon.
Host-focused search on the same service. This node returns the domain's DNS records instead.
Actively resolves DNS records against your own resolvers. DNSDumpster Lookup is passive.
Active multi-technique DNS enumeration. Use it when you want to query the domain directly.
faq
related
Generate lookalike domains and flag registered typosquats.
Look up the real IP of a host from its favicon via Shodan.
Email OSINT from public sources, with optional breach checks.
Check whether emails and usernames are available, taken, or invalid.
Passive DNSDumpster host lookup by domain.
List public repositories for each GitHub username you already have.
A domain feeds DNSDumpster DNS Lookup, which returns its DNS records passively and passes the hosts to httpx before they land as output.
Facts on this page come from the live Trickest tool library.