DNS (RECON) | Notion

These are tools used during DNS reconnaissance to gather information about a target domain before a penetration test or bug bounty assessment. Each tool has a different purpose.

Tool	What it does	Example
dig	The most powerful DNS lookup tool. Can query almost any DNS record (A, AAAA, MX, NS, TXT, SOA, etc.) and provides detailed output.	`dig example.com A`
nslookup	A simpler DNS lookup tool used to quickly find a domain's IP address or mail server.	`nslookup example.com`
host	A lightweight tool that returns concise DNS information. Easier to read than `dig`.	`host example.com`
dnsenum	An automated DNS enumeration tool that discovers subdomains, retrieves DNS records, and attempts zone transfers (if allowed).	`dnsenum example.com`
fierce	A DNS reconnaissance tool focused on finding subdomains using recursive searches and brute force techniques.	`fierce --domain example.com`
dnsrecon	A comprehensive DNS enumeration tool that combines multiple techniques, such as record lookups, brute forcing, and zone transfer attempts.	`dnsrecon -d example.com`
theHarvester	An OSINT (Open-Source Intelligence) tool that collects information such as email addresses, subdomains, employee names, and hosts from DNS records and public sources.	`theHarvester -d example.com -b all`
Online DNS Lookup Services	Web-based tools that allow you to perform DNS lookups without installing software. Useful for quick checks.	MXToolbox, DNSChecker, Google Admin Toolbox

When to use each tool

dig – Best for detailed DNS analysis and troubleshooting.
nslookup – Best for quick DNS lookups.
host – Best for simple, readable DNS queries.
dnsenum – Best for automated DNS enumeration and subdomain discovery.
fierce – Best for brute-forcing subdomains and finding hidden hosts.
dnsrecon – Best for comprehensive DNS reconnaissance during penetration testing.
theHarvester – Best for gathering OSINT such as emails, subdomains, and employee information.
Online DNS tools – Best when you don't have access to a terminal or need a quick lookup.

The Domain Information Groper (Dig) :

dig (Domain Information Groper) is a command-line tool used to query DNS servers and retrieve DNS records. It is widely used for DNS troubleshooting and reconnaissance.

Common Commands

Command	Purpose
`dig domain.com`	Retrieves the default A (IPv4) record.
`dig domain.com A`	Retrieves the IPv4 address.
`dig domain.com AAAA`	Retrieves the IPv6 address.
`dig domain.com MX`	Finds the domain's mail servers.
`dig domain.com NS`	Finds the authoritative name servers.
`dig domain.com TXT`	Retrieves TXT records (e.g., SPF, DKIM, DMARC).
`dig domain.com CNAME`	Retrieves the canonical name (alias).
`dig domain.com SOA`	Retrieves the Start of Authority (SOA) record.
`dig @1.1.1.1 domain.com`	Queries a specific DNS server.
`dig +trace domain.com`	Shows the complete DNS resolution path.
`dig -x <IP>`	Performs a reverse DNS lookup (IP → hostname).
`dig +short domain.com`	Displays only the answer.
`dig +noall +answer domain.com`	Displays only the Answer section.
`dig domain.com ANY`	Attempts to retrieve all DNS records (often blocked by modern DNS servers).

Note: During reconnaissance, dig is commonly used to discover IP addresses, mail servers, name servers, TXT records, and other DNS information about a target domain.