security enabled verified low v1.0.0

dnsrecon

DNS enumeration script that performs SRV record discovery, subdomain bruteforce, DNSSEC testing, zone transfer attempts, and reverse DNS lookups.

📋 Live Preview

dnsrecon {flag-type} {flag-threads} {flag-csv} {flag-json} {flag-db} {flag-dnsserver} {flag-range} {flag-nameserver} {flag-dictionary} {domain}

📎 flag-type 📎 flag-threads 📎 flag-csv 📎 flag-json 📎 flag-db 📎 flag-dnsserver 📎 flag-range 📎 flag-nameserver 📎 flag-dictionary 📎 domain

dnsrecon {flag-type} {flag-threads} {flag-csv} {flag-json} {flag-db} {flag-dnsserver} {flag-range} {flag-nameserver} {flag-dictionary} {domain}

Sandbox: execFile · Timeout: 300s

Capabilities

dns.enum.records

dns.enum.subdomain

dns.enum.zone-transfer

dns.enum.reverse

dns.test.dnssec

Parameters

Name	Type	Required	Default	Description	Aliases
`domain`	string	No	-	Target domain name	`-d`, `--domain`
`flag-type`	string	No	-	Scan type (std, rvl, brd, brt, srv, axfr, zonewalk)	`-t`, `--type`
`flag-nameserver`	string	No	-	Target DNS server	`-n`, `--name-server`
`flag-range`	string	No	-	IP range for reverse lookup (CIDR)	`-r`, `--range`
`flag-dictionary`	string	No	-	Wordlist file for bruteforce	`-D`, `--dictionary`
`flag-threads`	integer	No	-	Number of threads for bruteforce	`--threads`
`flag-csv`	boolean	No	-	Output in CSV format	`-c`, `--csv`
`flag-json`	boolean	No	-	Output in JSON format	`-j`, `--json`
`flag-db`	string	No	-	SQLite database file for output	`--db`
`flag-dnsserver`	string	No	-	Use specified DNS server for queries	`-s`, `--dnsserver`

Artifacts

Type	Description	MIME	Schema	Trust
`dns.records.json`	DNS records in JSON format	application/json	-	verified
`dns.records.csv`	DNS records in CSV format	text/csv	-	verified

Contract

Inputs

domain.name

Target domain name

network.target.host

Target DNS server

Outputs

dns.records.json

Discovered DNS records as JSON

dns.records.csv

Discovered DNS records as CSV

Side effects: network_traffic

Workflow Edges

Produces

dns.records.jsondns.records.csv

Consumes

domain.namenetwork.target.host

Resource Profile

Resource	Value
CPU	low
Memory	64 MB
Network	low
Disk I/O	low

Examples

Standard DNS enumeration

dnsrecon -d example.com

Zone transfer attempt

dnsrecon -d example.com -t axfr

Reverse DNS lookup on IP range

dnsrecon -r 192.168.1.0/24

Subdomain bruteforce with wordlist

dnsrecon -d example.com -D subdomains.txt -t brt

SRV record discovery

dnsrecon -d example.com -t srv

Documentation

dnsrecon — DNS Enumeration Script

dnsrecon is a Python-based DNS enumeration tool that performs various types of DNS reconnaissance including standard record enumeration, zone transfers, SRV record discovery, subdomain bruteforce, reverse lookups, and DNSSEC testing.

Usage

# Standard enumeration
dnsrecon -d example.com

# Zone transfer
dnsrecon -d example.com -t axfr

# Brute force subdomains
dnsrecon -d example.com -D wordlist.txt -t brt

# Reverse lookup
dnsrecon -r 10.0.0.0/24

# JSON output
dnsrecon -d example.com -j output.json

Dependencies

python3

Related Tools

dnsenumfierceamasssublist3rdig

References

dnsrecon GitHub