Find DNS Host Records | Subdomain Finder | HackerTarget.com (2024)

Find all Forward DNS (A) records for a domain. Enter a domain name and search for all subdomains associated with that domain. A handy reconnaissance tool when assessing an organisations security.

Valid Input 8.8.8.8 1.1.1.1-50 1.1.1.1/24 example.com

Recon: Find your targets with a DNS (A) record search

Use this hostname search to find all the forward DNS records (A recrds) for an organisation. A number of limits apply to FREE users including number of results and number of daily queries. Remove limits with a Membership or try the Domain profiler tool to get a full listing with additional meta data from the discovered hosts.

A forward DNS record (or A record) is used to determine an IP address from a human readable hostname. By searching all forward DNS records for a domain, attackers (or security penetration testers) can begin to understand the layout of an organisations Internet footprint. This type of reconnaissance can discover a wide range of hosts from multiple IP net blocks that can contain a wide range of services. With a good understanding of the perimeter the discovered systems can be assessed for security weak spots. The more hosts found the wider the potential attack surface.

Subdomain Enumeration Limits

Membership FREE USER
Queries / day# based on Plan50
Max # of Results500'000500
Data Set UpdatesHourlyWeekly

With a membership get up to half a million results from a single query. A gold mine of data for security analysts, network defenders and other cyber security professionals.

Updates to the DNS Data set are applied regularly from multiple sources. With a membership access newly discovered subdomains every hour.

Find DNS Host Records | Subdomain Finder | HackerTarget.com (1)

Forward DNS Hostname Search

The only function within the DNS protocol to identify all (A) records associated with a domain is to perform a DNS Zone Transfer. This zone transfer is a process that allows replication of DNS data between two DNS servers. However, it is deemed to be a security risk to leak all that DNS data so a properly configured DNS server should not allow a DNS zone transfer to non-authorized hosts.

Since it is likely that a DNS zone transfer will not work, we need another way to identify all the hosts associated with a domain. This discovery process can use a number of resources such as search engines, DNS data sets, brute forcing or crawling to enumerate subdomains.

Subdomain Enumeration from Search Engines

Search engines are a popular subdomain enumeration technique. Advantages of this method are that it is a passive search, in other words you are not sending any traffic to the target network or DNS servers. The search engine returns a list of results that contain the domain you are searching on. An example using Google is to perform the following query:

site:example.com

This will show all results from Google that contain the domain site.com. As it is likely that there are many results on www.example.com we can refine the search with the following query.

site:example.com -site:www.example.com

This will filter the www.example.com domain from the results, perhaps revealing a number of more interesting subdomains to target.

Brute Forcing Subdomains

A number of DNS enumeration tools and scripts are available that will simply take a list of keywords (potential subdomains) and attempt to resolve these against the target domain. This is not an entirely passive undertaking as the DNS resolution goes to the target domains DNS server and results in many failed lookups.

If someone is closely monitoring the DNS server of the target domain they will be able to detect that someone is performing a brute force subdomain scan against the domain.

There are a number of tools that can perform this enumeration, if you have Nmap installed there is an NSE script that will perform a DNS subdomain brute force (dns-brute).

DNS and SSL Data Sets for Subdomain Enumeration

Find DNS Host Records | Subdomain Finder | HackerTarget.com (2)The data we use to find host records here at hackertarget.com is sourced from a number of excellent projects as well as Internet search engines.

Scans.io is a project supported by Rapid 7 that compiles Internet scan data as well as DNS data sets, including both forward and reverse DNS records. By searching through the Forward DNS data set we can find all subdomains in the list that match a domain name query.

Another project is the censys.io project. This project from the University of Michigan also compiles a large amount of Internet scan data as well SSL data. Searching the SSL records can reveal host names of target domains. There is an API available or the full data sets can be downloaded.

Certificate transparency logs are yet another excellent source of host data. A project that allows browsers to confirm the validity of SSL certificates in near real time. Certificate transparency also happens to be an excellent source for performing reconnaissance against target domains.

Related IP Tools

We have a number of other related tools in our IP Tools suite that may be of interest. The Reverse DNS Lookup enables searching reverse PTR records for a domain and the Reverse IP search identifies hosts sharing an IP address. By combining these tools it should be possible to get a very good indication of where an organisations Internet systems are located both from IP address and physical location if used in conjunction with GeoIP lookups.

Domain Profiler for Attack Surface Discovery

Find DNS Host Records | Subdomain Finder | HackerTarget.com (3)

Use the Domain Profiler tool to perform automated reconnaissance against a domain name. This provides a quick overview of an organisations Internet facing infrastructure within a few minutes.

Results are collected passively; no packets are sent against the target IP ranges resulting in a very stealthy way to assess an organizations perimeter.

Learn More

Scan Membership

Forward DNS search API

Rather than using the form above you can also access the forward DNS tool using the API. The output is simply plain text and will include the IP address and the forward DNS host name. Data from the tool can be easily imported into a spreadsheet or other tool for reference purposes.

https://api.hackertarget.com/hostsearch/?q=example.com

This query will display the forward DNS records discovered using the data sets outlined above.

The API is simple to use and aims to be a quick reference tool; like all our IP Tools there is a limit of 50 queries per day. Remove limits with a Full Membership.

For those who need to send more packets upgrade to HackerTarget.com Enterprise Plans.

Automated Security Vulnerability Scans.

Discover. Investigate. Learn.

Use Cases

Website Recon?

Fingerprint Web App
Technologies in Bulk

Whatweb / Wappalyzer

Remove limits with a full membership

More info available

Membership

Find DNS Host Records | Subdomain Finder | HackerTarget.com (2024)

FAQs

How do I find out where my DNS records are hosted? ›

Find the DNS host

Go to https://who.is/ and search for your domain. In the search results, the section labeled Name Servers shows the location of your DNS host.

How do I look up a DNS record? ›

The most efficient way to check DNS records of the domain is to use a terminal with the command nslookup. This command will run on almost all operating systems (Windows, Linux, and macOS).

How do I get a list of DNS records? ›

Using nslookup online is very simple. Enter a domain name in the search bar above and hit 'enter'. This will take you to an overview of DNS records for the domain name you specified. Behind the scenes, NsLookup.io will query a DNS server for DNS records without caching the results.

How do I trace a DNS lookup command? ›

Access your command prompt. Use the command nslookup (this stands for Name Server Lookup) followed by the domain name or IP address you want to trace. Press enter. This command will simply query the Name Service for information about the specified IP address or domain name.

Can I see my DNS history? ›

Type cmd in the Start menu search bar to open Command Prompt. Then click Run as administrator. Enter the command ipconfig/displaydns and hit Enter. You'll see your detailed DNS cache history.

What is the command to see DNS records? ›

Type nslookup -q=XX domain_name where XX is a type of a DNS record and domain_name is the domain you want to look up the record for. Some of the available types of records are MX, A, CNAME, and TXT. The records are then displayed.

What command is used to lookup DNS records? ›

The nslookup command is helpful in diagnosing issues with DNS name resolution. This command is comparable to Mac or Linux's dig function. It can find the IP address of a host or perform a reverse DNS lookup (to find the domain name of an IP). Nslookup can also provide information on DNS records for your domain.

How do I trace a DNS issue? ›

A typical dig command will show you an Authority Section. You can see if the DNS is pointing correctly. Use it with +trace in dig +trace combination “dig +trace YOURDOMAIN” to see the whole route of your query. This way you can locate the exact problem.

How do I run a DNS lookup? ›

Follow these steps to do it right:
  1. Open the command prompt.
  2. Type nslookup followed by the IP address and press 'Enter. ' For example, it can be nslookup 8.8. 8.8.
  3. Now, the command prompt will return the DNS name and the associated IP you entered.
Jul 12, 2024

How do I retrieve old DNS records? ›

If you want to recover lost DNS records, follow this steps:
  1. Open up securitytrails.com.
  2. Enter your domain name.
  3. Move to the Historical Data block.
  4. Choose your DNS record type.
  5. Your old and current DNS records values should be displayed and ordered by date on the left side, as you see below.

How to use command dig? ›

How to Use the Dig Command?
  1. Open Command Prompt or Terminal: Depending on your operating system (OS), open the Command Prompt (Windows) or Terminal (MacOS/Linux).
  2. Install Dig (if not already installed): ...
  3. Run the Dig Command: In the Command Prompt or Terminal, type dig followed by the domain name you want to query.

How to find DNS server of a website? ›

Additionally, Microsoft Windows has nslookup, a built-in command-line tool for checking DNS records. To access nslookup, open a command prompt window by opening the Windows Start Menu or pressing the Windows key on your keyboard. Then, just type “nslookup” while the Start Menu is open.

How to check internal DNS records? ›

You can use Nslookup command to check DNS Records. All your machines that point to your internal DNS will resolve A record and PTR record succesfully. Nslookup A record or FQDN should return corresponding IP address. Nslookup IP address should return corresponding FQDN.

What is a dig tool? ›

Description. The dig (domain information groper) command is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the queried name server(s).

How do I check my DNS activity? ›

To search for DNS traffic:
  1. In the Threat Protection menu of Enterprise Center, select Reports > DNS Activity.
  2. To filter data based on date and time, see Filter data based on date and time.
  3. To configure and apply a filter, see Configure and apply a filter.
  4. Select a dimension or criteria to define what data is shown.

How do I know where my DNS is coming from? ›

You can run command nslookup -d2 domain name (for example: nslookup www.google.com) to check the process of resolution in detail including DNS client queries which DNS server.

Where is my DNS host file? ›

In Windows 10 the hosts file is located at c:\Windows\System32\Drivers\etc\hosts. Right click on Notepad in your start menu and select “Run as Administrator”. This is crucial to ensure you can make the required changes to the file. Now click File > Open and browse to : c:\Windows\System32\Drivers\etc\hosts.

Where are DNS servers hosted? ›

The DNS directory isn't located in one physical place or even one corner of the vast Internet. It's distributed all over the world and stored on many different servers that communicate with one another to regularly provide updates, information, and redundancies.

Where are DNS records stored on server? ›

DNS record types are records that provide important information about a hostname or domain. These records include the current IP address for a domain. Also, DNS records are stored in text files (zone files) on the authoritative DNS server.

References

Top Articles
Latest Posts
Recommended Articles
Article information

Author: Golda Nolan II

Last Updated:

Views: 5959

Rating: 4.8 / 5 (78 voted)

Reviews: 93% of readers found this page helpful

Author information

Name: Golda Nolan II

Birthday: 1998-05-14

Address: Suite 369 9754 Roberts Pines, West Benitaburgh, NM 69180-7958

Phone: +522993866487

Job: Sales Executive

Hobby: Worldbuilding, Shopping, Quilting, Cooking, Homebrewing, Leather crafting, Pet

Introduction: My name is Golda Nolan II, I am a thoughtful, clever, cute, jolly, brave, powerful, splendid person who loves writing and wants to share my knowledge and understanding with you.