---
name: "dnsrecon"
section: "1"
platform: "linux"
package: "dnsrecon"
version: "1.2.0-3"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/dnsrecon"
---

# dnsrecon(1)

DNS Enumeration and Scanning Tool

## NAME

dnsrecon - DNS Enumeration and Scanning Tool

## SYNOPSIS

**dnsrecon** \[**-h**\] \[**-d** *DOMAIN*\] \[**-n** *NS\_SERVER*\] \[**-r** *RANGE*\] \[**-D** *DICTIONARY*\] \[**-f**\] \[**-a**\] \[**-s**\] \[**-b**\] \[**-k**\] \[**-w**\] \[**-z**\] \[**-y**\] \[**--threads** *THREADS*\] \[**--lifetime** *LIFETIME*\] \[**--tcp**\] \[**--db** *DB*\] \[**-x** *XML*\] \[**-c** *CSV*\] \[**-j** *JSON*\] \[**--iw**\] \[**--disable\_check\_recursion**\] \[**--disable\_check\_bindversion**\] \[**-v**\] \[**-V**\] \[**-t** *TYPE*\]

## DESCRIPTION

dsnrecon is a simple python script that enables to gather DNS-oriented information on a given target.

## OPTIONS

- **-h**, **--help**

  show help message and exit

- **-d** *DOMAIN*, **--domain** *DOMAIN*

  Target domain.

- **-n** *NS\_SERVER*, **--name\_server** *NS\_SERVER*

  Domain server to use. If none is given, the SOA of the target will be used. Multiple servers can be specified using a comma separated list.

- **-r** *RANGE*, **--range** *RANGE*

  IP range for reverse lookup brute force in formats (first-last) or in (range/bitmask).

- **-D** *DICTIONARY*, **--dictionary** *DICTIONARY*

  Dictionary file of subdomain and hostnames to use for brute force. Filter out of brute force domain lookup, records that resolve to the wildcard defined IP address when saving records.

- **-f**

  Filter out of brute force domain lookup, records that resolve to the wildcard defined IP address when saving records.

- **-a**

  Perform AXFR with standard enumeration.

- **-b**

  Perform Bing enumeration with standard enumeration.

- **-s**

  Perform a reverse lookup of IPv4 ranges in the SPF record with standard enumeration.

- **-y**

  Perform Yandex enumeration with standard enumeration.

- **-k**

  Perform crt.sh enumeration with standard enumeration.

- **-w**

  Perform deep whois record analysis and reverse lookup of IP ranges found through Whois when doing a standard enumeration.

- **-z**

  Performs a DNSSEC zone walk with standard enumeration.

- **--threads** *THREADS*

  Number of threads to use in reverse lookups, forward lookups, brute force and SRV record enumeration.

- **--lifetime** *LIFETIME*

  Time to wait for a server to respond to a query. default is 3.

- **--tcp**

  Use TCP protocol to make queries.

- **--db** *DB*

  SQLite 3 file to save found records.

- **-x** *XML*, **--xml** *XML*

  XML file to save found records.

- **-c** *CSV*, **--csv** *CSV*

  Comma separated value file.

- **-j** *JSON*, **--json** *JSON*

  JSON file.

- **--iw**

  Continue brute forcing a domain even if wildcard records are discovered.

- **--disable\_check\_recursion**

  Disables check for recursion on name servers

- **--disable\_check\_bindversion**

  Disables check for BIND version on name servers

- **-v**

  Enable verbose

- **-V**

  Show version

- **-t** *TYPE*, **--type** *TYPE*

  Type of enumeration to perform. There are several possible types:

-

  • **std**: SOA, NS, A, AAAA, MX and SRV.

-

  • **rvl**: Reverse lookup of a given CIDR or IP range.

-

  • **brt**: Brute force domains and hosts using a given dictionary.

-

  • **srv**: SRV records.

-

  • **axfr**: Test all NS servers for a zone transfer.

-

  • **bing**: Perform Bing search for subdomains and hosts.

-

  • **yand**: Perform Yandex search for subdomains and hosts.

-

  • **crt**: Perform crt.sh search for subdomains and hosts.

-

  • **snoop**: Perform cache snooping against all NS servers for a given domain, testing all with file containing the domains, file given with -D option.

-

  • **tld**: Remove the TLD of given domain and test against all TLDs registered in IANA.

-

  • **zonewalk**: Perform a DNSSEC zone walk using NSEC records.

## EXAMPLES

- **attempts a zone transfer (AXFR) on the zonetransfer.me domain**

  dnsrecon -t axfr -d zonetransfer.me