> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 53 - DNS

> DNS enumeration: zone transfers, subdomain brute-force, reverse lookups, and DNS tunneling.

## Service Detection

```bash theme={"dark"}
nmap -sV -sC -p 53 TARGET
nmap -sU -p 53 TARGET
```

***

## Zone Transfer (AXFR)

Full dump of all DNS records. Often misconfigured.

```bash theme={"dark"}
dig axfr @TARGET domain.com
```

```bash theme={"dark"}
host -t axfr domain.com TARGET
```

```bash theme={"dark"}
nmap -p 53 --script dns-zone-transfer --script-args dns-zone-transfer.domain=domain.com TARGET
```

***

## Enumeration

### A Record

```bash theme={"dark"}
dig @TARGET domain.com A
host domain.com TARGET
```

### MX Record

```bash theme={"dark"}
dig @TARGET domain.com MX
```

### NS Record

```bash theme={"dark"}
dig @TARGET domain.com NS
```

### TXT Record (SPF, DKIM)

```bash theme={"dark"}
dig @TARGET domain.com TXT
```

### Any Record

```bash theme={"dark"}
dig @TARGET domain.com ANY
```

### Reverse Lookup

```bash theme={"dark"}
dig @TARGET -x 10.10.10.5
```

### Reverse Lookup Sweep

```bash theme={"dark"}
for i in $(seq 1 254); do dig @TARGET -x 10.10.10.$i +short; done
```

***

## Subdomain Brute-Force

### dig

```bash theme={"dark"}
for sub in $(cat subdomains.txt); do dig @TARGET $sub.domain.com +short; done
```

### dnsenum

```bash theme={"dark"}
dnsenum --dnsserver TARGET domain.com
```

### dnsrecon

```bash theme={"dark"}
dnsrecon -d domain.com -n TARGET -t brt -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
```

### gobuster

```bash theme={"dark"}
gobuster dns -d domain.com -r TARGET:53 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
```

***

## DNS Cache Snooping

Check if domain was recently resolved (reveals internal browsing):

```bash theme={"dark"}
dig @TARGET google.com +norecurse
```

Non-zero answer = domain was in cache.

***

## Useful Records to Check

```bash theme={"dark"}
dig @TARGET _gc._tcp.domain.com SRV         # Global catalog
dig @TARGET _ldap._tcp.domain.com SRV       # LDAP
dig @TARGET _kerberos._tcp.domain.com SRV   # Kerberos
dig @TARGET _kpasswd._tcp.domain.com SRV    # Kerberos password
```

***

## Quick Reference

| Check           | Command                                               |
| --------------- | ----------------------------------------------------- |
| Zone transfer   | `dig axfr @TARGET domain.com`                         |
| All records     | `dig @TARGET domain.com ANY`                          |
| Subdomain brute | `gobuster dns -d domain.com -r TARGET:53 -w list.txt` |
| Reverse lookup  | `dig @TARGET -x IP`                                   |
| Enum            | `dnsenum --dnsserver TARGET domain.com`               |