Skip to content
HackIndex logo

HackIndex

DNS Record Enumeration

1 min read May 15, 2026

Pull common and uncommon records to map infrastructure. ANY queries often restricted; fall back to type-specific sweeps.

ANY Record Query

┌──(kali㉿kali)-[~]
└─$ dig ANY $DOMAIN @$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ dig $DOMAIN ANY +dnssec @$TARGET_IP

Returns all records the server allows. DNSSEC flag adds signatures; occasional extra leakage.

┌──(kali㉿kali)-[~]
└─$ nslookup -type=ANY $DOMAIN $TARGET_IP

Alternative syntax; test both when one fails.

┌──(kali㉿kali)-[~]
└─$ host -a $DOMAIN $TARGET_IP

Comprehensive dump; sometimes bypasses restrictions.

Exhaustive Record Type Sweep

Script all standard types when ANY blocked:

#!/usr/bin/env bash

DOMAIN="$1"
DNS_SERVER="$2"

TYPES="A AAAA AFSDB APL CAA CDNSKEY CDS CERT CNAME DHCID DLV DNAME DNSKEY DS HINFO HIP IPSECKEY KX LOC MX NAPTR NS NSEC NSEC3 NSEC3PARAM PTR RP RRSIG SIG SOA SRV SSHFP TA TKEY TLSA TSIG TXT SPF"

for t in $TYPES; do
  echo "== $t =="
  if [ -n "$DNS_SERVER" ]; then
    dig "$DOMAIN" "$t" @@"$DNS_SERVER" +noall +answer
  else
    dig "$DOMAIN" "$t" +noall +answer
  fi
  echo
done

Run as ./script.sh $DOMAIN $TARGET_IP. Non-empty answers indicate exposed records.

Targeted Common Records

SOA for primary server and admin email:

┌──(kali㉿kali)-[~]
└─$ nslookup -type=SOA $DOMAIN $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ dig SOA $DOMAIN @$TARGET_IP

MX for mail infrastructure:

┌──(kali㉿kali)-[~]
└─$ nslookup -type=MX $DOMAIN $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ dig MX $DOMAIN @$TARGET_IP

For full zone disclosure when the server permits it, see DNS Zone Transfer (AXFR). In AD environments, misconfigured ADIDNS records can be poisoned — see ADIDNS Poisoning and Hijacking.