loading
Loading content
loading
Recon
Active multi-technique DNS enumeration for assessments.
overview
Seed -d with a domain. -t picks the technique: std, axfr, rvl, zonewalk, and more. Output is DNS records and hosts ready for later probing.
Reach for it when one active pass must cover AXFR checks (-a), wordlist brute (-D), reverse PTR (-r), or DNSSEC walks (-z). --threads scales the lookup-heavy modes.
dnsx resolves a known list fast. dnsrecon covers more enumeration techniques in one tool. Confirm passive names from subfinder here, then hand live hosts to httpx.
use cases
Run an AXFR check across every name server to catch a misconfigured server that hands over the full zone in one request.
Point dnsrecon at a wordlist to discover A and AAAA records, with wildcard filtering so spurious matches do not bloat the results.
Run PTR lookups across a CIDR or range to tie addresses back to hostnames during infrastructure mapping.
Pull general, SRV, and SPF records and optionally walk DNSSEC zones to build a complete picture of a domain's DNS footprint.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Target domain to enumerate. |
| enumeration-type | STRING | -t | Technique to run (std, rvl, srv, axfr, bing, yand, snoop, tld, zonewalk). |
| dictionary-file | FILE | -D | Wordlist of subdomains and hostnames for brute force. |
| name-server | STRING | -n | DNS server(s) to query, comma-separated; defaults to the target SOA. |
| ip-range | STRING | -r | IP range or CIDR for reverse-lookup brute force. |
| axfr | BOOLEAN | -a | Perform AXFR zone-transfer checks with standard enumeration. |
| crt-enumeration | BOOLEAN | -k | Add crt.sh certificate enumeration to a standard run. |
| threads | STRING | --threads | Threads for reverse, forward, brute-force, and SRV enumeration. |
Showing key inputs. dnsrecon exposes 20 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Target domain. |
| enumeration-type | STRING | -t | Type of enumeration to perform: std, rvl, srv, axfr, bing, yand, snoop, tld, or zonewalk. |
| name-server | STRING | -n | Domain server(s) to use; defaults to the target SOA. Comma-separate multiple servers. |
| dictionary-file | FILE | -D | Dictionary file of subdomains and hostnames to use for brute force. |
| ip-range | STRING | -r | IP range for reverse-lookup brute force, as first-last or range/bitmask. |
| axfr | BOOLEAN | -a | Perform an AXFR zone-transfer check with standard enumeration. |
| crt-enumeration | BOOLEAN | -k | Add crt.sh certificate enumeration to a standard run. |
| bing-enumeration | BOOLEAN | -b | Add Bing enumeration to a standard run. |
| yandex-enumeration | BOOLEAN | -y | Add Yandex enumeration to a standard run. |
| dnssec-zone-walk | BOOLEAN | -z | Perform a DNSSEC zone walk with standard enumeration. |
| reverse-ipv4-lookup | BOOLEAN | -s | Reverse-lookup the IPv4 ranges in the SPF record during standard enumeration. |
| whois-analysis | BOOLEAN | -w | Perform deep whois analysis and reverse lookup of IP ranges found via whois during standard enumeration. |
| filter | BOOLEAN | -f | When saving records, filter out brute-force hits that resolve to the wildcard IP. |
| continue-bruteforcing | BOOLEAN | --iw | Continue brute forcing a domain even if a wildcard record is discovered. |
| threads | STRING | --threads | Number of threads for reverse, forward, brute-force, and SRV enumeration. |
| timeout | STRING | --lifetime | Time to wait for a server to respond to a query (default 3). |
| use-tcp | BOOLEAN | --tcp | Use TCP to make queries instead of UDP. |
| enable-verbose | BOOLEAN | -v | Enable verbose output. |
| disable-check-recursion | BOOLEAN | --disable-check-recursion | Disable the recursion check on name servers. |
| disable-check-bindversion | BOOLEAN | --disable-check-bindversion | Disable the BIND version check on name servers. |
example
# general records, AXFR zone-transfer test, and crt.sh in one standard passdnsrecon -d example.com -t std -a -k -n 198.51.100.53 --threads 20[*] std: Performing General Enumeration against: example.com...[-] DNSSEC is not configured for example.com[*] SOA ns1.example.com 198.51.100.53[*] NS ns1.example.com 198.51.100.53[*] NS ns2.example.com 198.51.100.54[*] MX mail.example.com 203.0.113.20[*] A example.com 203.0.113.10[*] TXT example.com v=spf1 include:_spf.example.com ~all[*] Enumerating SRV Records[+] SRV _sip._tcp.example.com sip.example.com 203.0.113.30 5060 100[+] 1 Record Foundguidance
Use dnsrecon for active, multi-technique DNS enumeration: zone-transfer tests, record pulls, brute force, reverse lookups, and DNSSEC walks. For high-throughput resolution of a known list, use dnsx. For passive discovery first, use subfinder.
Fast resolver and prober for a known list. dnsrecon covers more enumeration techniques in one tool.
Similar all-in-one DNS enumerator. dnsrecon adds DNSSEC zone walking and source plugins.
Lightweight subdomain and zone-transfer scanner. dnsrecon offers broader record and reverse-lookup coverage.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Multi-purpose DNS toolkit for resolution, record queries, and wordlist brute force.
A domain and a wordlist feed dnsrecon, which enumerates records, tests zone transfers, and brute-forces hosts, writing the DNS records as output.
Facts on this page come from the live Trickest tool library.