dnsenum

Enumerate DNS information for domain

$ dnsenum [domain.com]

$ dnsenum --dnsserver [8.8.8.8] [domain.com]

$ dnsenum --enum -f [wordlist.txt] [domain.com]

$ dnsenum -o [output.xml] [domain.com]

$ dnsenum --threads [10] [domain.com]

$ dnsenum --noreverse [domain.com]

dnsenum [options] domain

dnsenum is a DNS enumeration tool that gathers information about a domain's DNS infrastructure. It performs multiple queries to discover hosts, name servers, mail servers, and potential subdomains.
The tool attempts zone transfers, performs reverse lookups, and can brute force subdomains using wordlists. It also scrapes search engines for additional subdomain information and integrates results from multiple sources.
dnsenum is commonly used in penetration testing and security assessments to map an organization's DNS footprint and identify potential attack vectors.

DOMAIN

Target domain to enumerate.

DNS server to query.

Shorthand for DNS enumeration.

Wordlist for brute force.

Number of threads.

Output file (XML format).

Skip reverse lookups.

Include private IPs.

Display help information.

Only perform on domains you have authorization to test. Zone transfers typically blocked on properly configured servers. Brute forcing may be detected and blocked. Search scraping may hit rate limits.

dnsenum is a Perl-based tool developed for the security community. It became a standard reconnaissance tool in penetration testing distributions like Kali Linux, providing comprehensive DNS enumeration capabilities.

dig(1), nslookup(1), fierce(1), dnsrecon(1)