> For the complete documentation index, see [llms.txt](https://heathen.gitbook.io/oscp+-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heathen.gitbook.io/oscp+-notes/reconnaissance/discovery/dns-hostname.md).

# DNS Hostname

## DNSRecon

```bash
dnsrecon -d www.example.com -a 
```

```bash
dnsrecon -d www.example.com -t axfr
```

```bash
dnsrecon -d "startIP-endIP"
```

```bash
dnsrecon -d www.example.com -D "namelist" -t brt
```

## Dig

```bash
dig www.example.com + short
```

```bash
dig www.example.com MX
```

```bash
dig www.example.com NS
```

```bash
dig www.example.com> SOA
```

```bash
dig www.example.com ANY +noall +answer
```

```bash
dig -x www.example.com
```

```bash
dig -4 www.example.com (For IPv4)
```

```bash
dig -6 www.example.com (For IPv6)
```

```bash
dig www.example.com mx +noall +answer example.com ns +noall +answer
```

```bash
dig -t AXFR www.example.com
```

## DNSEnum

```bash
dnsenum --dnsserver 172.21.0.0 -enum intranet.megacorpone.xx
```

```bash
dnsenum --dnsserver 172.21.0.0 -enum management.megacorpone.xx
```

```bash
dnsenum --dnsserver 172.21.0.0 -enum www.megacorpone.xx
```