> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/dns.md).

# DNS

DNS enumeration is the process of gathering information about a domain by querying its DNS records. This helps in identifying subdomains, mail servers, name servers, and other valuable data that can be used in penetration testing and reconnaissance.

***

### **Types of Subdomain Enumeration**

#### **1. Vertical Co-Relation**

* Focuses on finding subdomains and related domains under the same parent domain.
* Example:
  * `example.com`
  * `mail.example.com`
  * `vpn.example.com`
  * `dev.example.com`

#### **2. Horizontal Co-Relation**

* Identifies domains that are related based on shared infrastructure, WHOIS records, or IP addresses.
* Example:
  * `example.com`
  * `example.net`
  * `example.org`
  * Domains sharing the same hosting provider or DNS records.

***

### **Common DNS Records**

| **Record Type** | **Description**                                                 |
| --------------- | --------------------------------------------------------------- |
| **A**           | Maps a domain to an IPv4 address                                |
| **AAAA**        | Maps a domain to an IPv6 address                                |
| **CNAME**       | Alias record pointing to another domain                         |
| **MX**          | Mail exchange record (Email servers)                            |
| **NS**          | Name servers for a domain                                       |
| **SOA**         | Start of Authority, contains administrative information         |
| **TXT**         | Used for various purposes, such as SPF records and verification |
| **PTR**         | Reverse DNS lookup, resolves IPs to domain names                |
| **SRV**         | Defines services for a domain (e.g., `_sip._tcp.example.com`)   |

### Reference

{% embed url="<https://sidxparab.gitbook.io/subdomain-enumeration-guide>" %}