dns-recon

What this skill does

Performs a full DNS record lookup on a target domain using dig, host, and nslookup. Enumerates A/AAAA/MX/NS/TXT/CNAME records, checks for zone transfer (AXFR) vulnerabilities, and verifies DNSSEC configuration.

When to use

• When mapping a domain's infrastructure (mail servers, name servers, IP ranges)
• When detecting misconfigured DNS zone transfer vulnerabilities
• When auditing SPF/DKIM/DMARC configuration status
• When identifying subdomain takeover candidates

Prerequisites

• Install the dnsutils package (includes dig, host, nslookup):

  # Ubuntu/Debian
  sudo apt-get install -y dnsutils
  # CentOS/RHEL
  sudo yum install -y bind-utils
  

• Environment variable SECSKILL_TARGET_DOMAIN: target domain

Inputs

Variable	Required	Description
SECSKILL_TARGET_DOMAIN	required	Domain to query (e.g. example.com)
SECSKILL_OUTPUT_DIR	optional	Directory for saving results (default: ./output)
SECSKILL_DNS_RESOLVER	optional	DNS resolver IP to use (default: system default)

Workflow

Step 1: Prepare environment

export TARGET="${SECSKILL_TARGET_DOMAIN:?Set the SECSKILL_TARGET_DOMAIN environment variable}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
export RESOLVER="${SECSKILL_DNS_RESOLVER:-}"
mkdir -p "$OUTDIR"
RESOLVER_OPT=""
[ -n "$RESOLVER" ] && RESOLVER_OPT="@${RESOLVER}"
echo "[*] Starting DNS recon: $TARGET"

Step 2: Query basic records (A, AAAA, MX, NS, TXT, CNAME)

OUTFILE="$OUTDIR/dns_records_${TARGET}.txt"
echo "===== DNS Record Query: $TARGET =====" > "$OUTFILE"
echo "Query time: $(date -u '+%Y-%m-%dT%H:%M:%SZ')" >> "$OUTFILE"
echo "" >> "$OUTFILE"

for RTYPE in A AAAA MX NS TXT CNAME SOA; do
  echo "--- ${RTYPE} record ---" | tee -a "$OUTFILE"
  dig $RESOLVER_OPT "$TARGET" "$RTYPE" +noall +answer 2>/dev/null \
    | tee -a "$OUTFILE"
  echo "" >> "$OUTFILE"
done

echo "[+] Basic record query complete"