OSINT
Pull a domain DNS footprint without probing it
dnsdumpster-dns-lookup is a passive DNS node that queries DNSDumpster for a root domain and writes the discovered host records: A records with IPs, name servers, mail servers, and TXT data, ready for downstream resolution and probing without touching the target's name servers.
overview
What dnsdumpster-dns-lookup does
Feed a root domain; the node queries DNSDumpster and writes host (A) records with IPs, name servers, mail servers, and TXT data to a file and folder for downstream steps.
Reach for it at the start of recon when you want a quiet DNS map before any active resolution or HTTP probing. Nothing is sent to the target's name servers.
Compared with dnsx or dnsrecon, this stays passive. Use dnsdumpster-host-search for a host-centric query on the same service. Pass returned hostnames to httpx or dnsx to verify what is live.
use cases
Where dnsdumpster-dns-lookup fits
Seed an attack-surface map passively
Pull a domain's hosts, name servers, and mail records from DNSDumpster to scope an engagement without sending traffic to the target.
Discover infrastructure for an asset inventory
Capture the DNS records tied to a root domain as a starting inventory the rest of the workflow expands and verifies.
Map a domain's mail and name-server setup
Read the MX, NS, and TXT records to see how a domain routes mail and delegates DNS before you probe any host.
Feed probing and resolution stages
Hand the returned hostnames to httpx or dnsx so the workflow continues from a passively gathered seed set.
reference
dnsdumpster-dns-lookup inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Root domain to enumerate (passed as the node's single input). |
Showing key inputs. dnsdumpster-dns-lookup exposes 1 inputs in total.
example
Run dnsdumpster-dns-lookup
# passive DNS records for a domain via DNSDumpster
dnsdumpster-dns-lookup example.comHost Records (A)
example.com 203.0.113.10 HTTP: nginx AS64500 Example Cloud
www.example.com 203.0.113.11 HTTP: nginx AS64500 Example Cloud
mail.example.com 203.0.113.25 SMTP AS64500 Example Cloud
DNS Servers
ns1.example.com 198.51.100.53 AS64500 Example Cloud
ns2.example.com 198.51.100.54 AS64500 Example Cloud
MX Records
10 mail.example.com
TXT: v=spf1 include:_spf.example.com ~allguidance
Choosing dnsdumpster-dns-lookup
Use DNSDumpster DNS Lookup at the start of recon when you want DNS records for a domain without querying it directly. For a host-centric search on the same service, use dnsdumpster-host-search. To actively resolve records yourself, use dnsx or dnsrecon.
dnsdumpster-host-search
Host-focused search on the same service. This node returns the domain's DNS records instead.
dnsx
Actively resolves DNS records against your own resolvers. DNSDumpster Lookup is passive.
dnsrecon
Active multi-technique DNS enumeration. Use it when you want to query the domain directly.
faq
dnsdumpster-dns-lookup questions
related
More OSINT tools
dnstwist
Generate lookalike domains and flag registered typosquats.
favup
Look up the real IP of a host from its favicon via Shodan.
Infoga
Email OSINT from public sources, with optional breach checks.
maigret
Username search that collects accounts and profile data into one dossier.
socialscan
Check whether emails and usernames are available, taken, or invalid.
dnsdumpster-host-search
Passive DNSDumpster host lookup by domain.
Run dnsdumpster-dns-lookup yourself
A domain feeds DNSDumpster DNS Lookup, which returns its DNS records passively and passes the hosts to httpx before they land as output.
Facts on this page come from the live Trickest tool library.