Recon
Map DNS records and catch leaking AXFRs
Active multi-technique DNS enumeration for assessments.
overview
What dnsrecon does
Seed -d with a domain. -t picks the technique: std, axfr, rvl, zonewalk, and more. Output is DNS records and hosts ready for later probing.
Reach for it when one active pass must cover AXFR checks (-a), wordlist brute (-D), reverse PTR (-r), or DNSSEC walks (-z). --threads scales the lookup-heavy modes.
dnsx resolves a known list fast. dnsrecon covers more enumeration techniques in one tool. Confirm passive names from subfinder here, then hand live hosts to httpx.
use cases
Where dnsrecon fits
Test name servers for zone transfers
Run an AXFR check across every name server to catch a misconfigured server that hands over the full zone in one request.
Brute-force subdomains and hosts
Point dnsrecon at a wordlist to discover A and AAAA records, with wildcard filtering so spurious matches do not bloat the results.
Reverse-map an IP range
Run PTR lookups across a CIDR or range to tie addresses back to hostnames during infrastructure mapping.
Enumerate the full DNS surface
Pull general, SRV, and SPF records and optionally walk DNSSEC zones to build a complete picture of a domain's DNS footprint.
reference
dnsrecon inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Target domain to enumerate. |
| enumeration-type | STRING | -t | Technique to run (std, rvl, srv, axfr, bing, yand, snoop, tld, zonewalk). |
| dictionary-file | FILE | -D | Wordlist of subdomains and hostnames for brute force. |
| name-server | STRING | -n | DNS server(s) to query, comma-separated; defaults to the target SOA. |
| ip-range | STRING | -r | IP range or CIDR for reverse-lookup brute force. |
| axfr | BOOLEAN | -a | Perform AXFR zone-transfer checks with standard enumeration. |
| crt-enumeration | BOOLEAN | -k | Add crt.sh certificate enumeration to a standard run. |
| threads | STRING | --threads | Threads for reverse, forward, brute-force, and SRV enumeration. |
Showing key inputs. dnsrecon exposes 20 inputs in total.
Full flag reference (20 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Target domain. |
| enumeration-type | STRING | -t | Type of enumeration to perform: std, rvl, srv, axfr, bing, yand, snoop, tld, or zonewalk. |
| name-server | STRING | -n | Domain server(s) to use; defaults to the target SOA. Comma-separate multiple servers. |
| dictionary-file | FILE | -D | Dictionary file of subdomains and hostnames to use for brute force. |
| ip-range | STRING | -r | IP range for reverse-lookup brute force, as first-last or range/bitmask. |
| axfr | BOOLEAN | -a | Perform an AXFR zone-transfer check with standard enumeration. |
| crt-enumeration | BOOLEAN | -k | Add crt.sh certificate enumeration to a standard run. |
| bing-enumeration | BOOLEAN | -b | Add Bing enumeration to a standard run. |
| yandex-enumeration | BOOLEAN | -y | Add Yandex enumeration to a standard run. |
| dnssec-zone-walk | BOOLEAN | -z | Perform a DNSSEC zone walk with standard enumeration. |
| reverse-ipv4-lookup | BOOLEAN | -s | Reverse-lookup the IPv4 ranges in the SPF record during standard enumeration. |
| whois-analysis | BOOLEAN | -w | Perform deep whois analysis and reverse lookup of IP ranges found via whois during standard enumeration. |
| filter | BOOLEAN | -f | When saving records, filter out brute-force hits that resolve to the wildcard IP. |
| continue-bruteforcing | BOOLEAN | --iw | Continue brute forcing a domain even if a wildcard record is discovered. |
| threads | STRING | --threads | Number of threads for reverse, forward, brute-force, and SRV enumeration. |
| timeout | STRING | --lifetime | Time to wait for a server to respond to a query (default 3). |
| use-tcp | BOOLEAN | --tcp | Use TCP to make queries instead of UDP. |
| enable-verbose | BOOLEAN | -v | Enable verbose output. |
| disable-check-recursion | BOOLEAN | --disable-check-recursion | Disable the recursion check on name servers. |
| disable-check-bindversion | BOOLEAN | --disable-check-bindversion | Disable the BIND version check on name servers. |
example
Run dnsrecon
# general records, AXFR zone-transfer test, and crt.sh in one standard passdnsrecon -d example.com -t std -a -k -n 198.51.100.53 --threads 20[*] std: Performing General Enumeration against: example.com...[-] DNSSEC is not configured for example.com[*] SOA ns1.example.com 198.51.100.53[*] NS ns1.example.com 198.51.100.53[*] NS ns2.example.com 198.51.100.54[*] MX mail.example.com 203.0.113.20[*] A example.com 203.0.113.10[*] TXT example.com v=spf1 include:_spf.example.com ~all[*] Enumerating SRV Records[+] SRV _sip._tcp.example.com sip.example.com 203.0.113.30 5060 100[+] 1 Record Foundguidance
Choosing dnsrecon
Use dnsrecon for active, multi-technique DNS enumeration: zone-transfer tests, record pulls, brute force, reverse lookups, and DNSSEC walks. For high-throughput resolution of a known list, use dnsx. For passive discovery first, use subfinder.
dnsx
Fast resolver and prober for a known list. dnsrecon covers more enumeration techniques in one tool.
dnsenum
Similar all-in-one DNS enumerator. dnsrecon adds DNSSEC zone walking and source plugins.
fierce
Lightweight subdomain and zone-transfer scanner. dnsrecon offers broader record and reverse-lookup coverage.
faq
dnsrecon questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run dnsrecon yourself
A domain and a wordlist feed dnsrecon, which enumerates records, tests zone transfers, and brute-forces hosts, writing the DNS records as output.
Facts on this page come from the live Trickest tool library.