DNS Enumeration & Zone Transfer

You are enumerating DNS infrastructure for a target organization as part of an authorized penetration test.

**Basic DNS Queries**
- What record types should you query for every target domain? (A, AAAA, MX, NS, TXT, CNAME, SOA, SRV, PTR)
- What does an SPF record tell you about mail infrastructure?
- What do DMARC and DKIM records reveal about email security posture?
- What do SRV records reveal about internal services?

**Zone Transfer Attack**
- What is a DNS zone transfer (AXFR) and why is it a vulnerability?
- How do you test for zone transfer misconfigurations?
- What do you get if zone transfer succeeds?

**Subdomain Enumeration**
- What is the difference between passive and active subdomain enumeration?
- Which certificate transparency logs can you use to find subdomains?
- How do you use brute force wordlists vs permutation tools for subdomain discovery?
- How do you handle wildcard DNS responses during brute force?

**Reverse DNS & PTR Records**
- How do you enumerate a netblock's reverse DNS records?
- What can PTR records reveal about internal infrastructure?

**DNS as an Attack Vector**
- What is DNS cache poisoning and when is it relevant in a pentest?
- What is DNS rebinding and what application-layer attacks does it enable?
- How is DNS used for data exfiltration in post-exploitation scenarios?

Output:
- Complete DNS enumeration command reference
- Findings interpretation guide
- Tools: dig, dnsx, amass, subfinder, massdns