dnsenum

DNS enumeration: records, zone transfers, brute force.

KaliParrotlow

pkg: dnsenum

dnsenum gathers DNS information — A/NS/MX records, attempts zone transfers, brute-forces subdomains and runs reverse lookups.

Syntax

dnsenum [options] {domain}

Example

dnsenum --enum example.com

Runs the full enumeration profile: records, zone transfer attempt, subdomain brute force and reverse lookups.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

--enumShortcut: run all default enumeration.
-f <subs.txt>Subdomain brute-force wordlist.
--dnsserver <8.8.8.8>Use a specific DNS server.
--noreverseSkip reverse lookups.
-o <out.xml>Write XML output.

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

dnsenum

Usage examples

dnsenum --enum target.tld

Full DNS enumeration.

dnsenum -f subs.txt target.tld

Brute-force subdomains with a wordlist.

Advantages
  • One-shot DNS recon workflow
  • Attempts zone transfers automatically
  • Built-in subdomain brute forcing
Disadvantages
  • Brute forcing is active and noisy
  • Slower than dedicated subdomain tools
  • Wordlist quality drives results
Tags
#dns#subdomains

Official docs: dnsenum

Related commands

Frequently asked questions

What is dnsenum used for?
dnsenum gathers DNS information — A/NS/MX records, attempts zone transfers, brute-forces subdomains and runs reverse lookups.
What is an example dnsenum command?
A common example is: dnsenum --enum example.com — Runs the full enumeration profile: records, zone transfer attempt, subdomain brute force and reverse lookups.
Is dnsenum part of Kali Linux?
Yes. dnsenum ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install dnsenum.
What category of security tool is dnsenum?
dnsenum is a Information Gathering tool with a low-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →