skills.rest
zebbern
zebbernCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

dns-recon

Enumerate DNS records and test zone transfers for a target domain.

5|3|Updated Apr 10, 2026
Search Tags:#reconnaissance#dns#dig#subdomain#dnsx#zone-transfer#dnsrecon
One-click install
npx skills add https://github.com/zebbern/termstack --skill dns-recon-zebbern
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dns-recon
Source: https://github.com/zebbern/termstack/tree/main/.github/skills/dns-recon
Command: npx skills add https://github.com/zebbern/termstack --skill dns-recon-zebbern

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

DNS reconnaissance helps identify how a domain's DNS is structured, exposing potential misconfigurations and exposure points.

Core Features & Use Cases

  • Record enumeration: Identify A, AAAA, NS, MX, TXT, CNAME, and other DNS records to map the DNS surface.
  • Zone transfer testing: Check for AXFR susceptibility to reveal subdomain exposure.
  • Reverse lookups & subdomain discovery: Map hostnames from IP ranges and uncover hidden subdomains.
  • DNSSEC and infrastructure assessment: Validate DNSSEC status and overall DNS infrastructure health.

Quick Start

Run a standard DNS reconnaissance on a target domain to enumerate records and identify zone-transfer vulnerabilities.

Frequently Asked Questions about dns-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate DNS records to map a domain's infrastructure?▼

To test for AXFR zone transfer vulnerabilities, you query the target domain's DNS servers to check if they permit unauthorized zone transfers. This process reveals subdomain exposure and misconfigurations using tools like dnsrecon or dig.

How do I test for AXFR zone transfer vulnerabilities on a target domain?▼

To test for AXFR zone transfer vulnerabilities, you query the target domain's DNS servers to check if they permit unauthorized zone transfers. This process reveals subdomain exposure and misconfigurations using tools like dnsrecon or dig.

What is the best way to discover hidden subdomains and perform reverse DNS lookups?▼

DNS reconnaissance handles non-responsive servers and NXDOMAIN responses through built-in error handling. This ensures the enumeration process continues smoothly despite resolution failures, reliably mapping available records without crashing.

How does DNS reconnaissance handle non-responsive servers and NXDOMAIN errors?▼

DNS reconnaissance handles non-responsive servers and NXDOMAIN responses through built-in error handling. This ensures the enumeration process continues smoothly despite resolution failures, reliably mapping available records without crashing.

Can I validate DNSSEC status and assess overall DNS infrastructure health?▼

DNS enumeration outputs can be exported to JSON or CSV formats. This structured data allows you to import the mapped DNS surface into downstream analysis tools for further infrastructure assessment and reporting.

Do I need specific tools to perform DNSSEC validation and infrastructure assessment?▼

You need tools like dnsx, dnsrecon, and dig to perform DNSSEC validation and infrastructure assessment. These tools support querying DNS records, testing zone transfers, and exporting results to JSON or CSV formats.

Related Skills

Explore More Software Engineering Skills→
rloisellrloisell
7

dns-tools

Diagnose DNS configuration issues with dig, nslookup, and host queries.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

proto-dns

Enumerate DNS records and analyze security configurations for authorized domains.

Community
Advanced
BrownFineSecurityBrownFineSecurity
811

nmap

Identify open ports and enumerate network services with Nmap.

Official
Advanced
cptnfrencptnfren
3

localsetup-cloudflare-dns

Manage Cloudflare DNS records from the terminal via a Python wrapper.

Community
Intermediate