Find DNS Host Records | Subdomain Finder | HackerTarget.com (2024)

Find all Forward DNS (A) records for a domain. Enter a domain name and search for all subdomains associated with that domain. A handy reconnaissance tool when assessing an organisations security.

Valid Input 8.8.8.8 1.1.1.1-50 1.1.1.1/24 example.com

Recon: Find your targets with a DNS (A) record search

Use this hostname search to find all the forward DNS records (A recrds) for an organisation. A number of limits apply to FREE users including number of results and number of daily queries. Remove limits with a Membership or try the Domain profiler tool to get a full listing with additional meta data from the discovered hosts.

A forward DNS record (or A record) is used to determine an IP address from a human readable hostname. By searching all forward DNS records for a domain, attackers (or security penetration testers) can begin to understand the layout of an organisations Internet footprint. This type of reconnaissance can discover a wide range of hosts from multiple IP net blocks that can contain a wide range of services. With a good understanding of the perimeter the discovered systems can be assessed for security weak spots. The more hosts found the wider the potential attack surface.

Subdomain Enumeration Limits

Membership FREE USER
Queries / day# based on Plan50
Max # of Results500'000500
Data Set UpdatesHourlyWeekly

With a membership get up to half a million results from a single query. A gold mine of data for security analysts, network defenders and other cyber security professionals.

Updates to the DNS Data set are applied regularly from multiple sources. With a membership access newly discovered subdomains every hour.

Find DNS Host Records | Subdomain Finder | HackerTarget.com (1)

Forward DNS Hostname Search

The only function within the DNS protocol to identify all (A) records associated with a domain is to perform a DNS Zone Transfer. This zone transfer is a process that allows replication of DNS data between two DNS servers. However, it is deemed to be a security risk to leak all that DNS data so a properly configured DNS server should not allow a DNS zone transfer to non-authorized hosts.

Since it is likely that a DNS zone transfer will not work, we need another way to identify all the hosts associated with a domain. This discovery process can use a number of resources such as search engines, DNS data sets, brute forcing or crawling to enumerate subdomains.

Subdomain Enumeration from Search Engines

Search engines are a popular subdomain enumeration technique. Advantages of this method are that it is a passive search, in other words you are not sending any traffic to the target network or DNS servers. The search engine returns a list of results that contain the domain you are searching on. An example using Google is to perform the following query:

site:example.com

This will show all results from Google that contain the domain site.com. As it is likely that there are many results on www.example.com we can refine the search with the following query.

site:example.com -site:www.example.com

This will filter the www.example.com domain from the results, perhaps revealing a number of more interesting subdomains to target.

Brute Forcing Subdomains

A number of DNS enumeration tools and scripts are available that will simply take a list of keywords (potential subdomains) and attempt to resolve these against the target domain. This is not an entirely passive undertaking as the DNS resolution goes to the target domains DNS server and results in many failed lookups.

If someone is closely monitoring the DNS server of the target domain they will be able to detect that someone is performing a brute force subdomain scan against the domain.

There are a number of tools that can perform this enumeration, if you have Nmap installed there is an NSE script that will perform a DNS subdomain brute force (dns-brute).

DNS and SSL Data Sets for Subdomain Enumeration

Find DNS Host Records | Subdomain Finder | HackerTarget.com (2)The data we use to find host records here at hackertarget.com is sourced from a number of excellent projects as well as Internet search engines.

Scans.io is a project supported by Rapid 7 that compiles Internet scan data as well as DNS data sets, including both forward and reverse DNS records. By searching through the Forward DNS data set we can find all subdomains in the list that match a domain name query.

Another project is the censys.io project. This project from the University of Michigan also compiles a large amount of Internet scan data as well SSL data. Searching the SSL records can reveal host names of target domains. There is an API available or the full data sets can be downloaded.

Certificate transparency logs are yet another excellent source of host data. A project that allows browsers to confirm the validity of SSL certificates in near real time. Certificate transparency also happens to be an excellent source for performing reconnaissance against target domains.

Related IP Tools

We have a number of other related tools in our IP Tools suite that may be of interest. The Reverse DNS Lookup enables searching reverse PTR records for a domain and the Reverse IP search identifies hosts sharing an IP address. By combining these tools it should be possible to get a very good indication of where an organisations Internet systems are located both from IP address and physical location if used in conjunction with GeoIP lookups.

Domain Profiler for Attack Surface Discovery

Find DNS Host Records | Subdomain Finder | HackerTarget.com (3)

Use the Domain Profiler tool to perform automated reconnaissance against a domain name. This provides a quick overview of an organisations Internet facing infrastructure within a few minutes.

Results are collected passively; no packets are sent against the target IP ranges resulting in a very stealthy way to assess an organizations perimeter.

Learn More

Scan Membership

Forward DNS search API

Rather than using the form above you can also access the forward DNS tool using the API. The output is simply plain text and will include the IP address and the forward DNS host name. Data from the tool can be easily imported into a spreadsheet or other tool for reference purposes.

https://api.hackertarget.com/hostsearch/?q=example.com

This query will display the forward DNS records discovered using the data sets outlined above.

The API is simple to use and aims to be a quick reference tool; like all our IP Tools there is a limit of 50 queries per day. Remove limits with a Full Membership.

For those who need to send more packets upgrade to HackerTarget.com Enterprise Plans.

Automated Security Vulnerability Scans.

Discover. Investigate. Learn.

Use Cases

Website Recon?

Fingerprint Web App
Technologies in Bulk

Whatweb / Wappalyzer

Remove limits with a full membership

More info available

Membership

Find DNS Host Records | Subdomain Finder | HackerTarget.com (2024)

FAQs

How do I find out where my DNS records are hosted? ›

Find the DNS host

Go to https://who.is/ and search for your domain. In the search results, the section labeled Name Servers shows the location of your DNS host.

How do I get a list of DNS records? ›

Using nslookup online is very simple. Enter a domain name in the search bar above and hit 'enter'. This will take you to an overview of DNS records for the domain name you specified. Behind the scenes, NsLookup.io will query a DNS server for DNS records without caching the results.

How do I find all the hosts of a domain? ›

Use ICANN Lookup

The Internet Corporation for Assigned Names and Numbers (ICANN) is a non-profit organization that collects domain information. Use the ICANN Lookup tool to find your domain host. Go to lookup.icann.org.

Which DNS am I using on Android? ›

Go into Settings and under Wireless & Networks , tap on Wi-Fi. Tap and hold on your current connected Wi-Fi connection, until a pop-up window appears and select Modify Network Config. You should now be able to scroll down a list of options on your screen. Please scroll down until you see DNS 1 and DNS 2.

How do I look up a DNS record? ›

The most efficient way to check DNS records of the domain is to use a terminal with the command nslookup. This command will run on almost all operating systems (Windows, Linux, and macOS).

What DNS provider am I using? ›

Find your DNS hosting provider
  • On the InterNIC search page , in the Whois Search box, type your domain. For example, yahoo.com.
  • Select the Domain option, and then click Submit.
  • On the Whois Search Results page, locate the first Name Server entry.

How do I trace a DNS lookup command? ›

Access your command prompt. Use the command nslookup (this stands for Name Server Lookup) followed by the domain name or IP address you want to trace. Press enter. This command will simply query the Name Service for information about the specified IP address or domain name.

How to see DNS history? ›

Here's how to check your browsing history via the DNS cache:
  1. Type cmd in the Start menu search bar to open Command Prompt. Then click Run as administrator.
  2. Enter the command ipconfig/displaydns and hit Enter. You'll see your detailed DNS cache history.
Aug 25, 2023

What command is used to lookup DNS records? ›

Type nslookup and hit Enter. The displayed information will be your local DNS server and its IP address. You can specify the DNS server (IP address), type of record, and domain name.

How do I find all other hosts available on my network? ›

Performing nmap -sP 192.168. 1.1/24 will retrieve live hosts and after that if you try arp again, it will show the live hosts.

How do I find all my domains? ›

To find your domains, sign in to Google Domains with the Google account you used to register your domains. “My domains” lists each domain you own.

How do I find all available domains? ›

Search the WHOIS database

To find out if a domain name is available, type it into the WHOIS search tool, hit Enter, and look at the results. If it says something like “No data found”, the domain probably isn't taken, so go and get it.

What is a private DNS provider's hostname? ›

Enabling Private DNS Mode on Android means your searches and other DNS queries are encrypted and safe from prying eyes. Here's everything else you need to know. Written by Jack Wallen, Contributing Writer April 25, 2024 at 6:23 a.m. PT. Max Buondonno/ZDNET.

How to check DNS history in Android? ›

If you are using Google Chrome in your Android to play, there is a more thorough method of flushing DNS cache: Open Chrome. In the URL bar type in chrome://net-internals/#dns. In the left pane click DNS.

How do I find private DNS on Android? ›

To turn Private DNS on or off, or change its settings:
  1. Open your device's Settings app.
  2. Tap Network & internet. Private DNS.
  3. Pick your option: Off. Automatic. Private DNS provider hostname.
  4. Tap Save.

How do I know where my DNS is coming from? ›

You can run command nslookup -d2 domain name (for example: nslookup www.google.com) to check the process of resolution in detail including DNS client queries which DNS server.

Where are DNS host files located? ›

In Windows 10 the hosts file is located at c:\Windows\System32\Drivers\etc\hosts.

Where is the DNS server hosted? ›

The DNS directory isn't located in one physical place or even one corner of the vast Internet. It's distributed all over the world and stored on many different servers that communicate with one another to regularly provide updates, information, and redundancies.

Where is the DNS database location? ›

All of these files are located in the %SystemRoot%\system32\Dns directory, and all except the dummy boot file are built from standard resource records. A name server boot file points to sources of DNS information.

References

Top Articles
Latest Posts
Recommended Articles
Article information

Author: Prof. An Powlowski

Last Updated:

Views: 6604

Rating: 4.3 / 5 (64 voted)

Reviews: 87% of readers found this page helpful

Author information

Name: Prof. An Powlowski

Birthday: 1992-09-29

Address: Apt. 994 8891 Orval Hill, Brittnyburgh, AZ 41023-0398

Phone: +26417467956738

Job: District Marketing Strategist

Hobby: Embroidery, Bodybuilding, Motor sports, Amateur radio, Wood carving, Whittling, Air sports

Introduction: My name is Prof. An Powlowski, I am a charming, helpful, attractive, good, graceful, thoughtful, vast person who loves writing and wants to share my knowledge and understanding with you.