---

DNSRecon is a powerful DNS enumeration tool written in Python. It performs various DNS record enumeration, zone transfers, subdomain brute forcing, and more.

---

Basic Usage

• dnsrecon -d <domain> - Standard enumeration

• dnsrecon -d <domain> -t std - Standard record enumeration

---

Enumeration Types (-t)

• std - Standard record enumeration (SOA, NS, A, AAAA, MX, TXT)

• rvl - Reverse lookup of IP range

• brt - Brute force subdomains and hosts

• srv - SRV record enumeration

• axfr - Zone transfer

• goo - Google search for subdomains

• bing - Bing search for subdomains

• snoop - DNS cache snooping

• tld - TLD expansion

• zonewalk - DNSSEC zone walk

---

Target Options

• -d <domain> - Target domain

• -r <range> - IP range for reverse lookup (CIDR or range)

• -n <ns> - Name server to use

• -D <file> - Wordlist for brute force

---

Output Options

• -c <file> - CSV output file

• -j <file> - JSON output file

• -x <file> - XML output file

• --db <file> - SQLite database output

---

Performance Options

• --threads <num> - Number of threads

• --lifetime <sec> - Query lifetime (timeout)

• --tcp - Use TCP for queries

---

Other Options

• -a - Perform AXFR with standard enumeration

• -s - Perform reverse lookup on IP ranges in SPF records

• -g - Perform Google enumeration

• -b - Perform Bing enumeration

• -k - Perform cache snooping

• -w - Perform deep whois lookup

• -z - Perform DNSSEC zone walk

• -v - Verbose output

---

Common Examples

Standard Enumeration

dnsrecon -d example.com

Get all standard DNS records.

Zone Transfer

dnsrecon -d example.com -t axfr

Attempt zone transfer.

Subdomain Brute Force

dnsrecon -d example.com -t brt -D /usr/share/wordlists/subdomains.txt

Brute force subdomains with wordlist.

Reverse Lookup

dnsrecon -r 192.168.1.0/24

Reverse DNS lookup on IP range.

SRV Record Enumeration

dnsrecon -d example.com -t srv

Enumerate SRV records.

Full Enumeration

dnsrecon -d example.com -a -s -g -w

Standard enum with AXFR, SPF, Google, and Whois.

DNSSEC Zone Walk

dnsrecon -d example.com -z

Enumerate via DNSSEC zone walking.

Save to JSON

dnsrecon -d example.com -j output.json

Save results to JSON file.

Custom Name Server

dnsrecon -d example.com -n 8.8.8.8

Use specific DNS resolver.

---

Tips

• Always try zone transfer (-t axfr) first

• Use -a with standard enum to include AXFR attempt

• Combine with other tools like amass for better coverage

• Save results to JSON for easy parsing

• DNSSEC zone walk can reveal records even when AXFR is blocked

• Use --threads to speed up brute forcing

• Check SRV records for internal services

• Always get authorization before scanning

---