search

Practical DNS Enumeration Using Dnsenum in Kali Linux

Nerd Cafe | نرد کافه

Let’s walk through DNS record types using a concrete, practical example for:

http://nerd-cafe.ir/

Assume you own this domain and want to:

  • Host a website

  • Use email

  • Add a blog subdomain

  • Secure it with SPF/DKIM

  • Point www correctly

We’ll build it step by step.

hashtag
Step 1 — A Record (IPv4 Address Mapping)

hashtag
What it does

Maps a domain name → IPv4 address.

hashtag
Example

You buy a VPS with this IP:

185.143.233.5

To make nerd-cafe.ir open your website:

Type
Name
Value

A

@

185.143.233.5

hashtag
Result:

When someone types:

DNS translates it to:

The browser connects to your server.

hashtag
Step 2 — AAAA Record (IPv6 Address)

Same idea as A record, but for IPv6.

If your server also has:

Add:

Type
Name
Value

AAAA

@

2a01:4f8:1c1b:abcd::1

Now IPv6 users can reach your site.

hashtag
Step 3 — CNAME Record (Alias)

hashtag
What it does

Makes one domain name an alias of another.

You want:

to point to:

Add:

Type
Name
Value

CNAME

www

nerd-cafe.ir

Now:

Important rule:

  • CNAME cannot exist together with other records on the same name.

hashtag
Step 4 — MX Record (Mail Server)

hashtag
What it does

Tells the world which server handles email for your domain.

Let’s say you use:

  • Gmail (Google Workspace)

Google gives you:

Add:

Type
Name
Value
Priority

MX

@

ASPMX.L.GOOGLE.COM

1

Now emails to:

are delivered to Google.

hashtag
Step 5 — TXT Record (Verification, SPF, Security)

TXT records store text information.

hashtag
Example 1 — SPF (prevent email spoofing)

Type
Name
Value

TXT

@

v=spf1 include:_spf.google.com ~all

This tells email servers:

Only Google is allowed to send emails for nerd-cafe.ir.

hashtag
Example 2 — Google verification

Type
Name
Value

TXT

@

google-site-verification=abc123xyz

Used to verify domain ownership.

hashtag
Step 6 — DKIM (Email Signing)

Google gives you something like:

Type
Name
Value

TXT

google._domainkey

long public key string

This digitally signs your outgoing emails.

hashtag
Step 7 — NS Record (Nameservers)

hashtag
What it does

Tells the internet which DNS provider manages your domain.

Example:

Type
Name
Value

NS

@

ns1.yourhost.com

NS

@

ns2.yourhost.com

Without NS records, nothing works.

hashtag
Step 8 — SRV Record (Advanced Services)

Used for services like VoIP, chat, etc.

Example for a SIP server:

Type
Name
Value

SRV

_sip._tcp

sipserver.nerd-cafe.ir:5060

Not common for basic websites, but important in enterprise setups.

hashtag
Step 9 — Subdomain Example

You want:

Hosted on another server:

Add:

Type
Name
Value

A

blog

192.168.10.50

Now blog traffic goes to a different machine.

hashtag
Full Practical Setup (Minimal Working Example)

For a working website + email setup, you typically need:

hashtag
Quick Summary

Record
Purpose

A

Domain → IPv4

AAAA

Domain → IPv6

CNAME

Alias

MX

Email routing

TXT

Verification / SPF / DKIM

NS

DNS authority

SRV

Service location

hashtag
Step 1: Basic Domain Enumeration

hashtag
Command:

hashtag
What It Does:

  • Retrieves:

    • A record (IP)

    • NS records

    • MX records

    • SOA record

  • Attempts zone transfer

  • Performs basic subdomain brute-force

hashtag
Step 2: Enumerate Specific Record Types

hashtag
A Record Lookup

Avoids reverse lookups to speed up scan.

hashtag
Step 3: Subdomain Brute Forcing

hashtag
Using Built-in Wordlist

hashtag
Step 5: Enumerate Mail Servers

MX records:

Look for:

Useful for:

  • Email spoofing tests

  • Phishing simulation

  • Identifying email infrastructure

hashtag
Step 6: Save Output to File

Useful for:

  • Reporting

  • Parsing with other tools

  • Automation

hashtag
💖 Support Our Work

If you find this post helpful and would like to support my work, you can send a donation via TRC-20 (USDT). Your contributions help us keep creating and sharing more valuable content.

octagon-check

TRC-20 Address: TAAVVf9ZxUpbyvTa6Gd5SGPmctBdy4PQwf

Thank you for your generosity! 🙏

hashtag
Keywords

DNS enumeration, dnsenum, Kali Linux, reconnaissance, subdomain discovery, zone transfer, AXFR, DNS records, A record, MX record, NS record, SOA record, brute force, wordlist, reverse lookup, penetration testing, attack surface mapping, OSINT, network security, ethical hacking , Nerd Cafe , نرد کافه

hashtag
Channel Overview

🌐 Website: www.nerd-cafe.irarrow-up-right

📺 YouTube: @nerd-cafearrow-up-right

🎥 Aparat: nerd_cafearrow-up-right

📌 Pinterest: nerd_cafearrow-up-right

📱 Telegram: @nerd_cafearrow-up-right

📝 Blog: Nerd Café on Virgoolarrow-up-right

💻 GitHub: nerd-cafearrow-up-right

PreviousReconnaissance Methodologies for Penetration Testing Using OWASP AmassNextModule 03: Scanning Networks

Last updated