Skip to content
HackIndex.io

DNS Record Enumeration

4 min read Created Jan 3, 2026 Last updated May 15, 2026

DNS record enumeration maps the target's infrastructure. Each record type reveals different details: A and AAAA records point to hosts, MX records expose mail servers, TXT records leak SPF/DKIM config, and SRV records can expose internal service ports. ANY queries return everything the server is willing to share in a single response, but resolvers increasingly refuse or truncate them. When ANY fails, query each type individually.

  • A / AAAA records map hostnames to IPv4 and IPv6 addresses, identifying live hosts.
  • MX records expose mail servers and their priority, often on separate infrastructure.
  • TXT records leak SPF, DKIM, and DMARC configurations, listing authorized senders and cloud services.
  • SRV records reveal internal service names and ports not visible through standard A lookups.
  • SOA records identify the primary nameserver, admin contact, and zone serial for change tracking.
  • CNAME records show service aliases and third-party integrations worth checking for takeover.

ANY Record Query

┌──(kali㉿kali)-[~]
└─$ dig ANY $DOMAIN @$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ dig $DOMAIN ANY +dnssec @$TARGET_IP

Check the ANSWER section for populated records. DNSSEC responses include RRSIG signatures alongside each returned record. If the server returns REFUSED or a truncated response with no useful data, ANY is blocked on this server. The +dnssec flag occasionally surfaces extra records the server omits from standard ANY responses.

┌──(kali㉿kali)-[~]
└─$ nslookup -type=ANY $DOMAIN $TARGET_IP

Some servers distinguish between dig and nslookup requests. Test both. One may return results where the other gets REFUSED or empty answers. Inconsistent responses between tools suggest ACL-based filtering on the server side.

┌──(kali㉿kali)-[~]
└─$ host -a $DOMAIN $TARGET_IP

The host -a query is equivalent to ANY and sometimes bypasses filters that block explicit ANY queries. Servers configured to refuse dig ANY sometimes respond to host -a because the wire-format query differs slightly. Check the ANSWER section carefully for anything that did not appear in the previous responses.

Exhaustive Record Type Sweep

Script all standard types when ANY is blocked or returns incomplete results. This covers every IANA-registered DNS record type, including DNSSEC types that rarely appear but can expose zone signing infrastructure when returned.

#!/usr/bin/env bash

DOMAIN="$1"
DNS_SERVER="$2"

TYPES="A AAAA AFSDB APL CAA CDNSKEY CDS CERT CNAME DHCID DLV DNAME DNSKEY DS HINFO HIP IPSECKEY KX LOC MX NAPTR NS NSEC NSEC3 NSEC3PARAM PTR RP RRSIG SIG SOA SRV SSHFP TA TKEY TLSA TSIG TXT SPF"

for t in $TYPES; do
  echo "== $t =="
  if [ -n "$DNS_SERVER" ]; then
    dig "$DOMAIN" "$t" @"$DNS_SERVER" +noall +answer
  else
    dig "$DOMAIN" "$t" +noall +answer
  fi
  echo
done

Pass the domain and optional DNS server as arguments. The script queries each type in sequence and prints only non-empty answers. Empty output for a type means the server returned nothing for it. Prioritize reviewing SOA, NS, MX, TXT, SRV, and CNAME results first. SRV records are especially useful: they expose internal service names and ports that do not appear in standard A record lookups.

Targeted Common Records

The SOA record identifies the primary authoritative nameserver and the zone admin contact. The admin email is encoded with a dot instead of an at-sign: a value like admin.example.com means admin@example.com. The serial number increments on each zone change and can indicate how recently the zone configuration was modified.

┌──(kali㉿kali)-[~]
└─$ nslookup -type=SOA $DOMAIN $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ dig SOA $DOMAIN @$TARGET_IP

MX records list mail servers in priority order. Lower numbers have higher priority. Mail servers typically run on separate infrastructure from the web stack. Resolve A records for each MX hostname to get their IPs. Mail servers often accept SMTP connections on port 25 and are worth including in scope for further enumeration.

┌──(kali㉿kali)-[~]
└─$ nslookup -type=MX $DOMAIN $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ dig MX $DOMAIN @$TARGET_IP

Record enumeration gives a broad map of publicly exposed infrastructure. Use NS records to identify all authoritative nameservers, then attempt a zone transfer against each one separately. In Active Directory environments, ADIDNS stores dynamic records for domain-joined hosts and services. Misconfigured permissions on those records allow adding or overwriting entries, enabling name poisoning attacks. For full zone disclosure when the server permits it, see DNS Zone Transfer (AXFR). In AD environments, misconfigured ADIDNS records can be poisoned: see ADIDNS Poisoning and Hijacking.