Objective

Learn how to identify a domain's authoritative name server and perform a DNS Zone Transfer (AXFR) to retrieve DNS records.

Find the Authoritative Name Server

dig <domain> NS

If the domain is internal (e.g., HTB), query the target's DNS server directly:

dig @<DNS_SERVER_IP> <domain> NS

Purpose: Identify the authoritative name server for the target domain.

Perform a DNS Zone Transfer

dig axfr @<DNS_SERVER_IP> <domain>

Command Breakdown

Option Description
dig DNS lookup utility
axfr Requests a DNS Zone Transfer
@<DNS_SERVER_IP> Target DNS server
<domain> Target domain

Analyze the Results

Information Discovered

A successful AXFR may reveal: