performing-dns-enumeration-and-zone-transfer

What problem does it solve? During authorized penetration tests, security consultants need to map a target organization's external attack surface, but DNS information is scattered across record types, nameservers, and passive data sources. This Skill provides a structured workflow to enumerate DNS records, test for zone transfer misconfigurations, and discover subdomains systematically. ## Core Features & Use Cases - Zone Transfer Testing: Attempts AXFR/IXFR transfers against authoritative nameservers to detect misconfigurations that leak entire zone files. - Subdomain Discovery: Combines passive sources (subfinder, amass, certificate transparency logs) with active brute-forcing (gobuster, dnsenum) and deduplicates results. - Security Configuration Analysis: Validates DNSSEC, SPF, DKIM, DMARC, open resolvers, wildcard records, and internal IP disclosure. - Use Case: A consultant scoping a web application pentest runs this workflow against example.com, discovers ns2 allows zone transfers revealing 347 records, finds 15 subdomains leaking internal RFC1918 addresses, and reports an exposed staging environment. ## Quick Start Enumerate all DNS records and subdomains for the authorized target domain example.com, attempt zone transfers against its nameservers, and produce a findings report.