# DNS

> DNS maps domains to IPs. Attackers probe records, zone transfers, and subdomains, then exploit misconfigs for poisoning, takeover, hijacking, tunneling, and covert exfiltration via encoded queries

- **URL:** https://hackindex.io/services/dns
- **Type:** Service
- **Default ports:** 53
- **Tags:** dns, udp, tcp, recon, network, enumeration
- **Published:** 2025-12-31
- **Updated:** 2026-07-13

DNS (Domain Name System) runs on **TCP and UDP port 53**. Nmap identifies it as `domain`. DNS translates hostnames to IP addresses and is a core service on virtually every network. Common implementations include BIND, Microsoft DNS, dnsmasq, and Unbound.

DNS is a goldmine for reconnaissance. Zone transfers (AXFR) can leak the entire domain inventory when misconfigured. Reverse lookups, subdomain brute-forcing, and record enumeration (MX, TXT, SRV, PTR) reveal internal hostnames, mail servers, and service locations. DNS can also be abused for data exfiltration tunneling.

Check for zone transfers first, then enumerate subdomains and record types. Tools like `dig`, `dnsenum`, and `dnsrecon` automate most of this. If the resolver allows recursive queries from external hosts, it can be leveraged for DNS amplification attacks.

## Phases

- [Enumeration](https://hackindex.io/services/dns/enumeration.md): DNS records, zone transfers, subdomains, and misconfig probing guides (6 guides)
- [Exploitation](https://hackindex.io/services/dns/exploitation.md): DNS exploitation guides covering poisoning, takeover, and hijacking (7 guides)
- [Data Exfiltration](https://hackindex.io/services/dns/data-exfiltration.md): Exfiltrate data via DNS queries using dnscat2, iodine, and manual methods (1 guides)