Perl-based DNS enumeration tool that performs comprehensive DNS record queries, brute forcing, reverse lookups, and zone transfers.
dnsenum {domain} 🌍 domain → example.com dnsenum {domain}Sandbox: execFile · Timeout: 600s
network.discovery.dns network.discovery.subdomain security.recon.dns service.dns.zone-transfer | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
domain | string | Yes | - | Target domain name | - |
dnsserver | string | No | - | Use this DNS server for A, NS and MX queries | --dnsserver |
enum | boolean | No | - | Shortcut equivalent to --threads 5 -s 15 -w | --enum |
noreverse | boolean | No | - | Skip the reverse lookup operations | --noreverse |
nocolor | boolean | No | - | Disable ANSI color output | --nocolor |
private | boolean | No | - | Show and save private IPs in domain_ips.txt | --private |
flag-t | integer | No | 10 | TCP and UDP timeout in seconds | -t, --timeout |
threads | integer | No | 5 | Number of threads for queries | --threads |
flag-v | boolean | No | - | Verbose output | -v, --verbose |
flag-p | integer | No | 5 | Google search pages to process | -p, --pages |
flag-s | integer | No | 15 | Max subdomains to scrape from Google | -s, --scrap |
flag-f | file | No | - | Subdomain wordlist file for brute force | -f, --file |
flag-u | string | No | - | Update file with valid subdomains (a|g|r|z) | -u, --update |
flag-r | boolean | No | - | Recursively brute force subdomains with NS records | -r, --recursion |
flag-d | integer | No | 3 | Max delay between whois queries | -d, --delay |
flag-w | boolean | No | - | Perform whois queries on C class network ranges | -w, --whois |
flag-e | string | No | - | Exclude PTR records matching regexp | -e, --exclude |
flag-o | string | No | - | Output in XML format | -o, --output |
d | boolean | No | - | Max seconds between whois queries (default: 3s). | -d, --delay |
e | boolean | No | - | Exclude PTR records matching regexp. | -e, --exclude |
h | boolean | No | - | Print this help message. | -h, --help |
p | boolean | No | - | Google search pages to process (default: 5). | -p, --pages |
s | boolean | No | - | Max subdomains scraped from Google (default 15). | -s, --scrap |
subfile | boolean | No | - | Write all valid subdomains to this file. | --subfile |
u | boolean | No | - | Update file with valid subdomains. | -u, --update |
w | boolean | No | - | Perform whois queries on C class networks. | -w, --whois |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
security.recon.dns.records | DNS records discovered during enumeration | text/plain | - | verified |
security.recon.subdomain.list | Discovered subdomains | text/plain | - | verified |
Inputs
network.target.domain Target domain name
Outputs
security.recon.dns.records Collected DNS records
security.recon.subdomain.list Discovered subdomains
network_traffic Produces
security.recon.dns.recordssecurity.recon.subdomain.listConsumes
network.target.domain| Resource | Value |
|---|---|
| CPU | low |
| Memory | 32 MB |
| Network | low |
| Disk I/O | low |
Basic DNS enumeration
dnsenum example.comEnumeration with Google scraping and whois
dnsenum --enum example.comDNS brute force with custom wordlist
dnsenum -f /usr/share/wordlists/subdomains.txt example.comRecursive brute force on subdomains
dnsenum -r example.comUse specific DNS server
dnsenum --dnsserver 8.8.8.8 example.comOutput results to XML file
dnsenum -o results.xml example.comdnsenum is a comprehensive DNS enumeration Perl script that automates the process of gathering DNS information about a target domain. It performs zone transfers, brute forces subdomains, conducts reverse lookups, and can integrate with Google scraping.