> For the complete documentation index, see [llms.txt](https://docs.h4rithd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.h4rithd.com/tcp/53-dns.md).

# DNS | 53

```bash
                 +-----------+
                 |     .     |  ←----------------------|## Root Level [ . ] 
                 +-----------+
                       |
    +------------+------------+------------+
    |            |            |            | 
 +-------+   +-------+     +------+     +------+
 |  com. |   |  org. |     | net. |     |  lk. |  ←----|## TLDs [Top-Level Domains]
 +-------+   +-------+     +------+     +------+
     |                                      
 +------------------+
 |   h4rithd.com.   |  ←-------------------------------|## Second-Level Domain [SLD]
 +------------------+
          |
 +-------------------+
 | docs.h4rithd.com. |  ←------------------------------|## Subdomain [Third-Level]
 +-------------------+
          |
+---------------------------+
| staging.docs.h4rithd.com. |  ←-----------------------|## Hosts
+---------------------------+
                                               FQDN: docs.h4rithd.com
                                                     └──┘ └─────┘ └─┘
                                                  Subdomain SLD   TLD

### ROOT  →  The invisible Root of the domain hierarchy. (managed by ICANN)
### TLDs  →  Top-Level Domains. Commercial domain space (like .com, .org)
### SLDs  →  Second-Level Domains (your main domain name)
### Subs  →  Subdomains. Used to separate services like docs, blog, etc
### FQDN  →  The full Fully Qualified Domain Name
```

<table><thead><tr><th width="102" align="right">Type</th><th width="234" align="center">Name</th><th>Description</th></tr></thead><tbody><tr><td align="right">A</td><td align="center">Address Record</td><td>Maps a domain to an IPv4 address.</td></tr><tr><td align="right">AAAA</td><td align="center">IPv6 Address Record</td><td>Maps a domain to an IPv6 address.</td></tr><tr><td align="right">CNAME</td><td align="center">Canonical Name Record</td><td>Alias of one domain to another.</td></tr><tr><td align="right">MX</td><td align="center">Mail Exchange Record</td><td>Routes email to the correct mail server.</td></tr><tr><td align="right">NS</td><td align="center">Name Server Record</td><td>Specifies authoritative name servers.</td></tr><tr><td align="right">TXT</td><td align="center">Text Record</td><td>Arbitrary text, often used for SPF, DKIM, verification.</td></tr><tr><td align="right">SOA</td><td align="center">Start of Authority</td><td>Provides zone info: primary NS, contact, serial</td></tr><tr><td align="right">PTR</td><td align="center">Pointer Record</td><td>Used for reverse DNS lookups (IP → domain).</td></tr><tr><td align="right">SRV</td><td align="center">Service Locator</td><td>Defines location of services (used in VoIP, AD, etc.).</td></tr><tr><td align="right">SPF</td><td align="center">Sender Policy Framework</td><td>Helps fight spam by specifying allowed mail servers</td></tr><tr><td align="right">CAA</td><td align="center">Certification Authority Auth</td><td>Specifies which CAs can issue certs for the domain.</td></tr><tr><td align="right">NAPTR</td><td align="center">Naming Authority Pointer</td><td>Used for dynamic DNS, SIP, ENUM services.</td></tr><tr><td align="right">RP</td><td align="center">Responsible Person</td><td>Email address of the domain admin.</td></tr><tr><td align="right">AFSDB</td><td align="center">Andrew File System DB</td><td>Used for locating AFS or DCE services.</td></tr><tr><td align="right">HINFO</td><td align="center">Host Info Record</td><td>Specifies hardware &#x26; OS of a host (rarely used).</td></tr><tr><td align="right">ISDN</td><td align="center">ISDN Address Record</td><td>Maps domain to an ISDN number (obsolete).</td></tr><tr><td align="right">KEY</td><td align="center">Public Key Record</td><td>Used in DNSSEC (obsolete, replaced by DNSKEY).</td></tr><tr><td align="right">DNSKEY</td><td align="center">DNSSEC Public Key</td><td>Holds a public key for DNSSEC validation.</td></tr><tr><td align="right">RRSIG</td><td align="center">Resource Record Signature</td><td>Contains digital signature for DNSSEC data.</td></tr><tr><td align="right">NSEC</td><td align="center">Next Secure Record</td><td>Part of DNSSEC, lists next valid record.</td></tr><tr><td align="right">NSEC3</td><td align="center">Next Secure Record v3</td><td>Secure denial of existence (hash-based).</td></tr><tr><td align="right">DS</td><td align="center">Delegation Signer</td><td>Indicates that child zone is secured with DNSSEC.</td></tr><tr><td align="right">LOC</td><td align="center">Location Record</td><td>Specifies geographic location (lat/lon/altitude).</td></tr><tr><td align="right">DNAME</td><td align="center">Delegation Name Record</td><td>Like CNAME but for an entire subtree.</td></tr><tr><td align="right">TLSA</td><td align="center">TLS Authentication Record</td><td>Used in DANE to specify TLS certs.</td></tr><tr><td align="right">SSHFP</td><td align="center">SSH Public Key Fingerprint</td><td>Stores SSH key fingerprints for trust.</td></tr><tr><td align="right">SVCB</td><td align="center">Service Binding Record</td><td>New alternative to SRV for HTTPS/SVC discovery.</td></tr><tr><td align="right">HTTPS</td><td align="center">HTTPS Service Record</td><td>A variant of SVCB optimized for HTTPS.</td></tr><tr><td align="right">URI</td><td align="center">Uniform Resource Identifier</td><td>Maps domain to a URI.</td></tr><tr><td align="right">MB</td><td align="center">Mailbox Domain Name</td><td>Maps domain to a mailbox host (obsolete).</td></tr><tr><td align="right">MG</td><td align="center">Mail Group Member</td><td>Identifies members of a mail group (obsolete).</td></tr><tr><td align="right">MR</td><td align="center">Mail Rename Domain</td><td>Renames a mailbox (obsolete).</td></tr><tr><td align="right">MINFO</td><td align="center">Mailbox Info</td><td>Info about mailbox or mail list (obsolete).</td></tr><tr><td align="right">WKS</td><td align="center">Well-Known Service</td><td>Maps service name to IP/port (obsolete).</td></tr><tr><td align="right">X25</td><td align="center">X.25 Address Record</td><td>Maps to X.25 network address (obsolete).</td></tr></tbody></table>

```bash
#### /etc/resolv.conf
## ------------------| DNS Information Gathering  
dig h4rithd.com                      ### Queries A records from the default DNS server 
dig SOA h4rithd.com                  ### Gets Start of Authority record. A dot(.) becomes @ in email format (info.h4rithd.com. → info@h4rithd.com)
dig h4rithd.com ANY                  ### Queries all available DNS records   
dig h4rithd.com MX @$IP              ### Get mail server information  
dig h4rithd.com NS @$IP              ### Find name servers for the domain 
dig h4rithd.com ANY @$IP             ### Perform ANY query to get all available DNS records  
dig h4rithd.com TXT @$IP             ### Retrieve TXT records (SPF, DKIM, verification) 
dnsrecon -d h4rithd.com              ### Standard enumeration (A, MX, NS, SOA, TXT records)
dnsrecon -d h4rithd.com -t std       ### Same as above (explicit standard scan)
nslookup -query=ANY h4rithd.com $IP  ### Alternative method for all records
nmap -sU -p 53 --script dns-nsid $IP ### Get DNS server details (NSID)
nmap -sU -p 53 --script dns-recursion $IP    ### Check for recursive queries
nmap -sU -p 53 --script dns-cache-snoop $IP  ### Snoop DNS cache (may be blocked)
nmap -sU -p 53 --script "dns-*" --script-args dns-brute.domain=h4rithd.com $IP    ### Comprehensive Scan

## ------------------| Reverse DNS Lookup
host $IP                             ### Simplest reverse lookup (PTR record query)
nslookup $IP                         ### Interactive reverse DNS query
dig -x $IP @$IP                      ### Detailed reverse lookup using Google's DNS
nmap -R -sL 192.168.1.1-254          ### Force reverse DNS resolution
whois $IP | grep "Reverse DNS"       ### Check reverse DNS via WHOIS
dnsenum --reverse 192.168.1.0/24     ### Reverse lookup with DNSenum
dnsrecon -r 192.168.1.0/24 -n $IP    ### Reverse lookup for IP range
dnsrecon -r 192.168.1.1-192.168.1.254 -n $IP ### Specific IP range reverse lookup

## ------------------| Bulk Reverse Lookup (IP Range)
for ip in $(seq 1 254); do host 192.168.1.$ip; done | grep -v "not found"   ### Scan a /24 subnet for PTR records
dnsrecon -r 192.168.1.0/24 -n $IP    ### Automated reverse lookup for entire subnet (-r = range, -n = nameserver)

## ------------------| Using Metasploit for Reverse Lookup
msfconsole
use auxiliary/gather/dns_reverse_lookup
set RHOSTS 192.168.1.0/24
run

## ------------------| Zone Transfer Attempt
dig axfr @$IP                           ### Tests if nameserver allows anonymous zone transfers
dig axfr @$IP +tcp                      ### Use TCP instead of UDP (better for large transfers)
dig axfr h4rithd.com @$IP               ### Tests zone transfer for specific domain
dig axfr @h4rithd.com h4rithd.com       ### Test against specific nameserver 
dig axfr @$IP h4rithd.com +nocookie     ### Bypass DNS cookie protection 
dig axfr h4rithd.com @ns1.h4rithd.com   ### Manual zone transfer attempt
host -T -l h4rithd.com ns1.h4rithd.com  ### Alternative zone transfer method
dnsrecon -d h4rithd.com -t axfr         ### Test for zone transfer vulnerabilities
dnsrecon -d h4rithd.com -n ns1.h4rithd.com -t axfr     ### Test against specific nameserver
nmap -p 53 --script dns-zone-transfer --script-args dns-zone-transfer.domain=h4rithd.com $IP 

## ------------------| Brute-force Subdomains
dnsenum h4rithd.com                        ### Comprehensive DNS enumeration  
dnsrecon -r $IP/24 -d h4rithd.com -t brt   ### Brute-force hostnames for an IP range
dnsmap h4rithd.com -w /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt ### Subdomain brute-forcing  
dnsrecon -d h4rithd.com -D /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt -t brt ### Brute-force subdomains  
gobuster dns -d h4rithd.com -w /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt -t 50 ### Fast threaded brute-force  
dnsrecon -d h4rithd.com -D /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt -t brt -c results.csv ### Save to CSV
dnsenum --dnsserver $IP --enum -p 0 -s 0 -o subdomains.txt -f /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt h4rithd.com   
for sub in $(cat /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt);do dig $sub.<DOMAIN> @<IP> | grep -v ';\|SOA' | sed -r '/^\s*$/d' | grep $sub | tee -a subdomains.txt;done    

## ------------------| DNS Cache Snooping
dig @$IP h4rithd.com A +norecurse               ### Check if record exists in cache  
dnsrecon -d h4rithd.com -t snoop -n $IP         ### DNS cache snooping
dnschef --fakeip $IP --fakedomains h4rithd.com  ### Set up malicious DNS server  

## ------------------| DNSSEC Enumeration
ldns-walk h4rithd.com                  ### Walk through DNSSEC secured zone  
dnsrecon -d h4rithd.com -t std         ### Check for DNSSEC records  
dnsrecon -d h4rithd.com -t zonewalk    ### DNSSEC zone walking
nmap -sU -p 53 --script dns-nsec-enum --script-args dns-nsec-enum.domain=h4rithd.com $IP

## ------------------| DNS Exploitation
dns-fuzz $IP                           ### Test for DNS tunneling vulnerabilities  
dnsspoof -i eth0 -f hosts.txt          ### Another DNS spoofing tool  
dns-spoof -i eth0 -f hosts.txt         ### Spoof DNS responses (requires root)
dnsrecon -d h4rithd.com -t tld         ### Check for TLD expansion vulnerabilities  

## ------------------| Passive DNS Enumeration
sublist3r -d h4rithd.com               ### Find subdomains using OSINT  
amass enum -passive -d h4rithd.com     ### Passive subdomain enumeration  

## ------------------| Google-Fu for DNS
dnsrecon -d h4rithd.com -t goo         ### Google enumeration (OSINT technique)

## ------------------| Comprehensive Scan
dnsrecon -d h4rithd.com -a -z -s -w -b -y -k -t std,axfr,brt -c full_report.json
### -a = AXFR
### -z = Zone walking
### -s = SRV records
### -w = WHOIS
### -b = Bing search
### -y = Yandex search
### -k - Keep alive
### -t = All test types
### -c = JSON output
### -x report.xml = XML output
### -c report.csv = CSV output
### -j report.json = JSON output
```