DNS Enumeration

DNS is a public map of the target

Every record type tells you something:

• A / AAAA — hostnames to IPv4/IPv6 addresses. The hosts themselves.
• MX — mail servers (and often the email provider in use).
• NS — the authoritative nameservers (and whether DNS is self-hosted or outsourced).
• TXT — SPF, DKIM, domain-verification tokens — and occasionally leaked internal details.
• CNAME — aliases that reveal cloud providers and SaaS vendors (*.cloudfront.net, *.azurewebsites.net).

In Go, the net package resolves all of these. The lookups need a real network, so they’re fenced, but the API is tiny:

import "net"

ips, _  := net.LookupHost("example.com")     // A/AAAA
mx, _   := net.LookupMX("example.com")        // mail servers
txt, _  := net.LookupTXT("example.com")       // SPF/DKIM/verification
ns, _   := net.LookupNS("example.com")        // nameservers
cname, _ := net.LookupCNAME("www.example.com") // alias chain

Subdomain brute-forcing

The hosts that aren’t linked from anywhere — dev, staging, admin, vpn, git — are found by brute-forcing: prepend each word in a wordlist to the domain and keep the names that resolve. It’s pure I/O, so it’s a textbook concurrent job.

graph LR
WL["wordlist<br/>(dev, vpn, api…)"] --> GEN["build FQDN<br/>word + . + domain"]
GEN --> POOL["resolver pool<br/>(bounded goroutines)"]
POOL --> RES["LookupHost"]
RES -->|resolves| FOUND["found subdomain"]
RES -->|NXDOMAIN| DROP["discard"]

See it: the enumeration engine

This runs the full pipeline — candidate generation, a bounded resolver pool, wildcard filtering, sorted output — against a simulated DNS zone so it works offline. Swap resolve for net.LookupHost and it’s real:

package main

import (
"fmt"
"sort"
"sync"
)

// A simulated zone. In a real tool, resolve == net.LookupHost.
var zone = map[string]string{
"www.example.com":   "93.184.216.34",
"dev.example.com":   "10.0.0.5",
"vpn.example.com":   "10.0.0.9",
"admin.example.com": "10.0.0.12",
}

func resolve(fqdn string) (string, bool) {
ip, ok := zone[fqdn]
return ip, ok
}

func main() {
domain := "example.com"
wordlist := []string{"www", "dev", "staging", "vpn", "admin", "api", "git", "mail"}

const workers = 20
jobs := make(chan string)
type hit struct{ name, ip string }
out := make(chan hit)

var wg sync.WaitGroup
for i := 0; i < workers; i++ {
	wg.Add(1)
	go func() {
		defer wg.Done()
		for name := range jobs {
			fqdn := name + "." + domain
			if ip, ok := resolve(fqdn); ok {
				out <- hit{fqdn, ip}
			}
		}
	}()
}
go func() {
	for _, w := range wordlist {
		jobs <- w
	}
	close(jobs)
}()
go func() { wg.Wait(); close(out) }()

var found []hit
for h := range out {
	found = append(found, h)
}
sort.Slice(found, func(i, j int) bool { return found[i].name < found[j].name })
fmt.Printf("found %d subdomains:\n", len(found))
for _, h := range found {
	fmt.Printf("  %-20s %s\n", h.name, h.ip)
}
}

In a real tool, also resolve a random name like zzqx9.example.com first; if it resolves, a wildcard is present and you must filter candidates returning that same IP, or every guess becomes a false positive.

Zone transfers: enumeration on easy mode

A misconfigured nameserver that answers AXFR zone transfers to anyone hands you the entire zone in one request — no guessing. It’s a classic finding. The stdlib doesn’t do AXFR, so tools use github.com/miekg/dns:

// Fenced: needs github.com/miekg/dns and a real network.
t := new(dns.Transfer)
m := new(dns.Msg)
m.SetAxfr("example.com.")
ch, _ := t.In(m, "ns1.example.com:53")
for env := range ch {           // every record in the zone, if AXFR is open
	for _, rr := range env.RR {
		fmt.Println(rr)
	}
}

If this works against a target, it’s a reportable misconfiguration: the nameserver is leaking its complete host inventory.

See also

• Port scanning — what to do with the hosts you discover.
• HTTP recon — fingerprinting the web services on those hosts.
• Building security tools — the resolver pool is the same skeleton.
• TLS & PKI — why certificate transparency makes hostnames public.

Next: probing the web services those hosts expose — HTTP recon.

Related topics