> For the complete documentation index, see [llms.txt](https://paul-gleason.gitbook.io/sec-335-eth.-hacking-and-pen.-testing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://paul-gleason.gitbook.io/sec-335-eth.-hacking-and-pen.-testing/tools-recon/dns-enumeration.md).

# DNS-Enumeration

### NSLOOKUP

#### Usage:

To use DNS server in settings:

```
nslookup <ip>
```

Specify DNS server:

```
nslookup <ip> <dns-server>
```

### Dig

Find name server:

```
dig @<dns-server> +short NS <domain>
```

### NMAP

Find dns server in a network:

```
sudo nmap -Pn --open <network ID>/<subnet #> -p T:53 -oG <file-name>.txt
```

Clean output of dns server

```
cat <file-name>.txt | grep -v Nmap | grep -v / | awk '{print $2}'
```