dns-recon

Map DNS records and detect misconfigurations using dig, host, and nslookup.

21|1|Updated Apr 12, 2026
One-click install
npx skills add https://github.com/woohyun212/security-skill --skill dns-recon
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: dns-recon
Source: https://github.com/woohyun212/security-skill/tree/main/dns-recon
Command: npx skills add https://github.com/woohyun212/security-skill --skill dns-recon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

DNS record reconnaissance and zone transfer attempts to identify exposure and misconfigurations in domain infrastructure, enabling proactive defense.

Core Features & Use Cases

  • Enumerates A/AAAA/MX/NS/TXT/CNAME records and checks DNSSEC
  • Attempts AXFR zone transfers to assess potential data exposure
  • Helps verify SPF/DKIM/DMARC configurations and subdomain enumeration

Quick Start

Ask your AI to perform a full DNS reconnaissance against a domain and save the results to an output file.

Frequently Asked Questions about dns-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check DNS records and detect zone-transfer vulnerabilities for a domain?

DNS reconnaissance enumerates A, AAAA, MX, NS, TXT, and CNAME records while attempting AXFR zone transfers to detect misconfigurations and potential data exposure across target domains.

How does a DNS zone transfer work and when does it expose infrastructure data?

A DNS zone transfer attempts to pull all records from a name server, exposing subdomains and infrastructure mappings when misconfigurations allow unauthorized AXFR requests to succeed.

Do I need dig or nslookup installed to perform DNS reconnaissance?

Yes, performing DNS reconnaissance requires common DNS tools like dig, host, or nslookup installed in your environment, along with setting the SECSKILL_TARGET_DOMAIN environment variable.

Can I verify SPF, DKIM, and DMARC configurations during a DNS record scan?

Yes, DNS record reconnaissance extracts TXT records to help verify SPF, DKIM, and DMARC configurations, alongside checking DNSSEC status and mapping subdomain infrastructure.

What is the best way to map subdomains and verify DNSSEC status across multiple domains?

Comprehensive DNS reconnaissance maps subdomains and verifies DNSSEC status by querying specific record types and checking validation flags, with optional resolver overrides for targeted scanning.