DNSRecon: A Complete Guide to DNS Enumeration and Zone Transfer Testing

dnsrecon is a Python-based DNS enumeration and reconnaissance script written by Carlos Perez (darkoperator). It automates many of the manual DNS query techniques covered under dig and nslookup into a single tool, including standard record enumeration, zone transfer attempts, subdomain brute-forcing using wordlists, reverse lookups over IP ranges, SRV record enumeration, and Google/Bing-based subdomain scraping. It is one of the most widely used all-in-one DNS enumeration tools in the Kali Linux toolkit.

Installation

dnsrecon is pre-installed on Kali Linux. To install manually on other distributions:

# Kali/Debian (pre-installed, but to reinstall/update)
sudo apt update && sudo apt install dnsrecon -y

# From source (any Linux distro with Python 3)
git clone https://github.com/darkoperator/dnsrecon.git
cd dnsrecon
pip3 install -r requirements.txt --break-system-packages
python3 dnsrecon.py --help

Verify installation:

dnsrecon --help

Syntax

dnsrecon [OPTIONS]

Command-Line Options

Basic Usage

dnsrecon -d example.com

Expected output (standard scan -t std default):

[*] std: Performing General Enumeration against: example.com...
[-] DNSSEC is not configured for example.com
[*]      SOA a.iana-servers.net 199.43.135.53
[*]      NS a.iana-servers.net 199.43.135.53
[*]      NS b.iana-servers.net 199.43.133.53
[*]      MX 0 . (no MX record)
[*]      A example.com 93.184.216.34
[*]      TXT example.com "v=spf1 -all"
[+] 3 Records Found

Practical Examples

Example 1 — Standard DNS record enumeration

dnsrecon -d example.com -t std

[*] SOA a.iana-servers.net 199.43.135.53
[*] NS a.iana-servers.net 199.43.135.53
[*] A example.com 93.184.216.34
[+] 3 Records Found

Example 2 — Zone transfer attempt against all name servers

dnsrecon -d example.com -t axfr

[*] Checking for Zone Transfer for example.com name servers
[*] Resolving SOA record for example.com
[*] SOA a.iana-servers.net 199.43.135.53
[-] Zone Transfer Failed for a.iana-servers.net
[-] Zone Transfer Failed for b.iana-servers.net

Example 3 — Subdomain brute forcing with a dictionary

dnsrecon -d example.com -t brt -D /usr/share/wordlists/dnsmap.txt -f

[*] brt: Performing host and subdomain brute force against example.com...
[+] A www.example.com 93.184.216.34
[+] A mail.example.com 93.184.216.35
[+] 2 Records Found

Example 4 — Reverse lookup across an IP range

dnsrecon -r 93.184.216.0/24

[*] Performing Reverse Lookup from 93.184.216.0 to 93.184.216.255
[+] PTR 93.184.216.34 example.com
[+] 1 Records Found

Example 5 — SRV record enumeration (common in Active Directory environments)

dnsrecon -d corp.local -t srv

[*] srv: Enumerating SRV Records
[+] SRV _ldap._tcp.corp.local dc01.corp.local 389
[+] SRV _kerberos._tcp.corp.local dc01.corp.local 88
[+] 2 Records Found

Example 6 — Google/Bing search-based subdomain discovery

dnsrecon -d example.com -t crt

[*] crt: Performing Cert Transparency lookup for example.com
[+] A dev.example.com 93.184.216.40
[+] A staging.example.com 93.184.216.41

Example 7 — Saving results to JSON for later parsing

dnsrecon -d example.com -t std,brt -D /usr/share/wordlists/dnsmap.txt -j results.json

[*] Saving records to JSON file: results.json
[+] 5 Records Found

Example 8 — DNSSEC zone walk

dnsrecon -d example.com -t zonewalk

[*] Performing NSEC Zone Walk for example.com
[-] DNSSEC is not configured for example.com

Common Use Cases

• Comprehensive, one-command DNS record enumeration replacing multiple manual dig/nslookup queries.
• Testing every discovered name server for zone transfer vulnerabilities in a single pass.
• Brute-forcing subdomains using custom or built-in wordlists (e.g., SecLists, dnsmap.txt).
• Enumerating Active Directory service records (SRV) during internal penetration tests to locate domain controllers.
• Reverse-mapping entire IP address ranges owned by a target organization.
• Certificate Transparency (crt.sh) based subdomain discovery, useful for finding subdomains not listed in DNS brute-force wordlists.

Automation with Bash

Run a full multi-technique scan and store organized output per domain:

#!/bin/bash
# dnsrecon_full.sh
DOMAIN=$1
OUTDIR="dnsrecon_$DOMAIN"
mkdir -p "$OUTDIR"

dnsrecon -d "$DOMAIN" -t std,axfr,srv,crt \
  -j "$OUTDIR/results.json" \
  -c "$OUTDIR/results.csv"

echo "[+] Scan complete. Results in $OUTDIR/"

Batch scan multiple domains from a list:

#!/bin/bash
while IFS= read -r domain; do
    echo "[*] Scanning $domain"
    dnsrecon -d "$domain" -t std,axfr -j "results_${domain}.json"
done < domains.txt

Tips and Best Practices

• Always run -t axfr first — it’s fast, non-intrusive to brute force, and if it succeeds you get the entire zone instantly, making brute forcing unnecessary.
• Use SecLists’ subdomains-top1million-5000.txt or dnsmap.txt for the -D brute-force dictionary rather than tiny built-in lists.
• Use -t crt to leverage Certificate Transparency logs — this often finds subdomains that DNS brute-forcing with wordlists would miss entirely.
• Combine -f (filter wildcards) when brute-forcing against domains that use wildcard DNS records, or you’ll get thousands of false positives.
• Save output in JSON (-j) when you plan to feed results into other tools or scripts for correlation.

Troubleshooting

References

• Official GitHub repository: https://github.com/darkoperator/dnsrecon
• Kali Linux tool page: https://www.kali.org/tools/dnsrecon/
• SecLists wordlists (used with -D): https://github.com/danielmiessler/SecLists
• Certificate Transparency project: https://certificate.transparency.dev/