Overview
DNS records are a primary source for discovering subdomains and mapping an organization's infrastructure. This lesson covers using DNS records in subdomain enumeration.
Learning objectives
- Explain how DNS records aid subdomain discovery.
- Identify useful record types for enumeration.
- Connect DNS enumeration to the attack surface.
Core concept
DNS records (from the networking DNS module) map names to addresses and other data, and querying them reveals subdomains and infrastructure. Useful record types for enumeration include A/AAAA (subdomain → IP, confirming a name exists and where it points), CNAME (aliases revealing related names and services), MX (mail infrastructure), NS (name servers), and TXT (which can hint at services in use). DNS enumeration — both direct queries and techniques to discover names — is a core method for expanding the known subdomain set.
How it works
The researcher queries DNS for the in-scope domain to discover subdomains and infrastructure: resolving candidate subdomain names to see which exist (A/AAAA records confirm live names and their IPs), following CNAMEs to related services, and examining MX/NS/TXT records for additional infrastructure clues. Discovered subdomains that resolve are added to the (scope-verified) target set. DNS is authoritative for which names exist and where they point, making it a reliable, largely-passive enumeration source (ordinary public DNS resolution). Combined with certificate and passive-source techniques, it builds a comprehensive subdomain picture.
Practical example
Enumerating example.com via DNS, the researcher resolves candidate subdomains and finds api.example.com and staging.example.com have A records (they exist and point to specific IPs), while a CNAME reveals shop.example.com points to a related service. MX/NS records show the mail and name-server setup. These discovered, resolving subdomains (verified against scope) join the target set. DNS records provided authoritative confirmation of which subdomains exist and where they point — a reliable enumeration foundation.
Cybersecurity relevance
DNS is a foundational, largely-passive source for subdomain enumeration and infrastructure mapping — reliable because it authoritatively defines which names exist and resolve. It mirrors attacker recon and ties to the networking DNS module (records, resolution) and the ethical-hacking passive-recon DNS lesson. For defenders, it underscores that DNS exposes the external footprint, so managing DNS records and subdomain sprawl is important. In bug bounty, DNS enumeration (within scope) is a core method for expanding the authorized attack surface, complemented by certificate and passive-source techniques.
Common mistakes
- Ignoring DNS enumeration, missing subdomains and infrastructure clues.
- Not confirming records resolve (a candidate name without a record isn't a live target).
- Treating out-of-scope resolved subdomains as targets rather than verifying scope.
Key takeaways
- DNS records (A/AAAA, CNAME, MX, NS, TXT) reveal subdomains and infrastructure; A/AAAA confirm which names exist and where they point.
- DNS enumeration (largely passive, via public resolution) is a core, reliable method for expanding the subdomain set.
- It authoritatively defines existing names (mirroring attacker recon, tied to the DNS modules); verify resolved subdomains against scope, and complement with certificate/passive techniques.
Check your understanding
- Which DNS record types are most useful for confirming and discovering subdomains?
- Why is DNS considered a reliable, authoritative source for subdomain enumeration?