# Kerberos realm and KDC discovery

- **URL:** https://hackindex.io/services/kerberos/enumeration/kerberos-realm-and-kdc-discovery
- **Path:** Kerberos > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/kerberos/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-05-18

Realm and KDC discovery is mostly DNS SRV + basic KDC reachability checks. The output becomes the targeting base for [user enumeration](https://hackindex.io/services/kerberos/enumeration/kerberos-valid-user-enumeration), [AS-REP roastable account discovery](https://hackindex.io/services/kerberos/enumeration/as-rep-roastable-account-enumeration), and [SPN enumeration](https://hackindex.io/services/kerberos/enumeration/kerberos-spn-enumeration).

## DNS SRV discovery (authoritative source of KDCs)

Query both TCP and UDP SRV records. Kerberos supports both transports, and environments sometimes differ.

```bash
dig +short SRV _kerberos._tcp.$DOMAIN
dig +short SRV _kerberos._udp.$DOMAIN
```

If AD is in play, query the AD locator namespace for DCs and Kerberos. This often returns the actual DC hostnames even when `_kerberos._tcp.$DOMAIN` is sparse.

```bash
dig +short SRV _kerberos._tcp.dc._msdcs.$DOMAIN
dig +short SRV _ldap._tcp.dc._msdcs.$DOMAIN
```

What to expect:

- Hostnames and ports (usually 88) plus priority/weight.
- Multiple KDCs indicates multi-DC. Capture them all and test each; some are closer, some are filtered, some are read-only DCs.

What to do with results:

- Resolve returned hostnames to IPs and treat each as a candidate DC/KDC target list.
- If SRV returns nothing, either DNS is not authoritative/reachable from this vantage, or the realm isn’t `$DOMAIN`. Pivot to `realm discover` and general DNS enumeration.

## Nmap SRV enumeration (one command for common AD services)

Nmap has `dns-srv-enum` which pulls a bundle of common SRV records including Kerberos KDC and kpasswd.

```bash
nmap -p 53 --script dns-srv-enum --script-args "dns-srv-enum.domain=$DOMAIN" $TARGET_IP
```

Interpretation:

- Useful when `$TARGET_IP` is a DNS server for `$DOMAIN` (often a DC).
- If DNS is not on the target or recursion is blocked, run SRV queries directly against the domain’s DNS servers.

## realmd discovery (KDC + realm config hints)

`realm discover` returns discovered realm configuration and is built for AD/IPA discovery.

```bash
realm discover $DOMAIN
```

What to capture:

- Canonical realm name and server-software type (often `active-directory` when AD is detected).
- Discovered controllers and recommended client config.

What to do with results:

- If `realm discover` succeeds but DNS SRV didn’t, it’s a signal that discovery is happening through a different resolver path or SRV queries were blocked/pointed at the wrong DNS.

## KDC reachability and fingerprinting (port 88)

Basic TCP service fingerprint:

```bash
nmap -sV -p 88 $TARGET_IP
```

Kerberos commonly uses UDP 88 as well. Confirm UDP reachability explicitly:

```bash
nmap -sU -p 88 $TARGET_IP
```

What to do with results:

- If TCP 88 is open but UDP 88 is filtered, many Kerberos tools still work, but expect different behavior and more retries/timeouts.
- If both are filtered, Kerberos-based enumeration won’t work from this network segment.

## UDP “is it listening” probes (low confidence)

This is a weak signal only. UDP can drop silently even when a service is up, and netcat output isn’t a reliable indicator.

```bash
echo "" | nc -u -w1 $TARGET_IP 88
```

Use Nmap UDP results as the real decision input.

## Time skew check (Kerberos blocker)

Large clock skew can break ticket workflows later. Check it early and fix local time before wasting cycles.

> [!WARNING]
> `ntpdate` is deprecated/historical. Prefer `ntpdig` when available.

If `ntpdate` exists:

```bash
ntpdate -q $TARGET_IP
```

Modern alternative:

```bash
ntpdig $TARGET_IP
```

Interpretation:

- Large offsets can cause ticket requests to fail with clock skew errors. Fix local time sync before Kerberos-heavy stages.

## References

- [Kerberos in the Enterprise](https://cwiki.apache.org/confluence/display/DIRxINTEROP/Kerberos%2Bin%2Bthe%2BEnterprise) - DNS SRV queries for KDC discovery over TCP/UDP
- [Nmap dns-srv-enum](https://nmap.org/nsedoc/scripts/dns-srv-enum.html) - Enumerates SRV records including Kerberos KDC and kpasswd
- [RHEL realmd discovery](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/windows_integration_guide/realmd-domain) - realm discover output purpose
- [realm(8) manpage](https://manpages.debian.org/testing/realmd/realm.8.en.html) - Realmd discovery and Kerberos realm enrollment tooling
- [ntpdate documentation](https://www.ntp.org/documentation/4.2.8-series/ntpdate/) - Deprecation and replacement guidance
- [ntpdig(1)](https://manpages.debian.org/testing/ntpsec-ntpdate/ntpdig.1.en.html) - SNTP query client used as a modern replacement for ntpdate