Overview
DNS information is a rich source of passive reconnaissance, revealing an organization's domains, subdomains, and infrastructure clues. This lesson covers DNS as a recon source.
Learning objectives
- Explain what DNS reveals during recon.
- Identify useful DNS record types for recon.
- Connect DNS recon to mapping the attack surface.
Core concept
DNS (from the networking path) maps names to addresses and other records, and querying public DNS reveals a lot about an organization: its domains and subdomains, the IP addresses/hosting behind names (A/AAAA records), mail infrastructure (MX records), name servers (NS), and TXT records (which may indicate services or policies in use). Because DNS is a public system, looking up an organization's DNS records is largely passive and helps enumerate its externally visible footprint.
How it works
The tester queries public DNS for the in-scope domains to discover associated records: addresses that reveal hosting, mail servers, name servers, and subdomains that expand the known attack surface. Subdomain discovery is especially valuable, as each subdomain may host a different application or service to inventory. This DNS-derived picture feeds the asset inventory and guides later active phases. It stays passive when it relies on ordinary public DNS resolution; testers keep queries relevant to scope and avoid intrusive techniques against out-of-scope infrastructure.
Practical example
For an authorized target domain, the tester examines public DNS records: A/AAAA records show where key names point, MX records reveal the mail setup, NS records show the name servers, and subdomain discovery surfaces additional hosts (e.g. an app subdomain, a mail subdomain) to add to the in-scope inventory. This expands the understanding of the organization's externally visible footprint, guiding where to focus authorized testing — all from public DNS.
Cybersecurity relevance
DNS recon is a core passive technique for mapping an organization's external footprint, especially via subdomain discovery, and mirrors attacker profiling. It ties back to the DNS module (records, resolution) and forward to enumeration. For defenders, it underscores managing DNS exposure — unnecessary or forgotten subdomains and revealing records expand the attack surface. Testers use DNS to enumerate in-scope assets; keeping queries within scope and non-intrusive keeps the activity appropriately passive.
Common mistakes
- Ignoring subdomain discovery, missing much of the external attack surface.
- Treating discovered out-of-scope domains as testable rather than noting them excluded.
- Confusing passive DNS lookups with intrusive techniques against DNS infrastructure.
Key takeaways
- Public DNS reveals domains, subdomains, hosting (A/AAAA), mail (MX), name servers (NS), and TXT records — a rich passive recon source.
- Subdomain discovery is especially valuable for expanding the known attack surface into the asset inventory.
- DNS recon maps an organization's external footprint (mirroring attacker profiling); keep it within scope and non-intrusive, and note out-of-scope discoveries as excluded.
Check your understanding
- What kinds of information about an organization can public DNS records reveal?
- Why is subdomain discovery particularly valuable during reconnaissance?