DNS Enumeration

DNS resolves names to addresses and stores other records describing a domain. It normally uses UDP 53 for queries and TCP 53 for large responses and zone transfers. In Active Directory, DNS also locates domain controllers and domain services.

Identify the Domain

dig @TARGET example.local A
dig @TARGET example.local NS
dig @TARGET example.local MX

@TARGET sends the query to the target DNS server. Query types select address, name-server, and mail-server records.

Zone Transfer

dig @TARGET example.local AXFR

A successful transfer discloses the zone’s hostnames and addresses. Try each authoritative name server. A failed transfer is normal and only means the zone is not exposed this way.

Reverse Lookup

dig @TARGET -x 192.168.X.X

PTR records can identify domain controllers, file servers, and development systems.

Active Directory Records

dig @TARGET _ldap._tcp.dc._msdcs.example.local SRV
dig @TARGET _kerberos._tcp.example.local SRV

SRV records identify domain controllers and where LDAP and Kerberos listen. Deeper use belongs in the Active Directory methodology.

What to Record

• Domain name and authoritative name servers
• Hostnames and addresses from records or a zone transfer
• Mail servers and domain controllers
• Names needed in /etc/hosts for virtual hosting or service access

DNS names feed Web Content Discovery, SMB Enumeration, and the Active Directory workflow.