DNS

DNS Resolution

Note

This module performs direct DNS resolution using native protocols (Plain UDP/TCP and DoH) with advanced fallback and retry logic. It does not rely on any external APIs or third-party web services. Its behavior, including retry strategies, timeouts, and resolver configurations, is governed strictly by the global network settings. For comprehensive instructions on adjusting these parameters, refer to the Network Configuration page.

The DNS module is the core resolver engine for the framework. It provides robust, stateless execution pipelines to query 26 distinct types of DNS records alongside a foundational zone validation mechanism.

Capabilities

The module accepts Domains and Subdomains as input and routes requests to the corresponding DNS handlers.

Foundational Zone Validation

Warning

The Preflight DNS Check (preflight_dns) is a strictly mandatory prerequisite for this module. It verifies zone health by querying the SOA record through the domain's authoritative nameservers. If this function is disabled in your configuration, all other 26 functions in this module will automatically skip processing and will not execute, as they explicitly require the DNS OK tag generated by this check.

• Preflight DNS Check: Validates the domain's zone health. If the zone is broken or unresponsive, it tags the target as DNS Bad and returns a Status property indicating a broken zone. Otherwise, it approves the target with a DNS OK tag, allowing subsequent record queries to proceed.

Core Resolution

Note

All functions from this point forward require the target to successfully pass the preflight check (indicated by the DNS OK tag).

• IP Resolution: Resolves standard A and AAAA records to extract IPv4 and IPv6 addresses.
• Name Servers: Extracts authoritative name servers (NS records) and generates new Domain nodes for each valid server (evaluating Out Of Scope (see Scope Boundaries) status and assigning the NS tag).
• Start of Authority: Extracts the raw SOA record and its serial number. It deeply parses the record to extract the primary nameserver as a new Domain node, and reformats the responsible party string into a valid Email node.
• Canonical Name: Queries the CNAME record for both the core target and its www counterpart. It extracts the target alias, validates it, and generates a new Domain node (evaluating whether the target remains within the organizational scope).
• Wildcard Check: Probes the zone for wildcard (*) configurations by querying a randomized, non-existent subdomain. If the query succeeds, it confirms the wildcard's existence and extracts the specific IP addresses it resolves to.

Mail Security & Infrastructure

• Mail Exchange: Extracts MX records and their priorities, automatically sorting them by preference. It parses the records to extract the target mail server hostnames as new Domain nodes (assigning the MX tag and evaluating scope).
• Text Records: Extracts all generic TXT records associated with the domain, including SPF (Sender Policy Framework) configurations.
• DMARC: Specifically queries _dmarc endpoints to extract Domain-based Message Authentication, Reporting, and Conformance policies. It actively parses the policy to extract aggregate (rua) and forensic (ruf) reporting email addresses, validating and returning them as new Email nodes (evaluating organizational scope).
• DKIM: Actively brute-forces DomainKeys Identified Mail (DKIM) records using a built-in dictionary of common selectors (e.g., default, mail, google) alongside dynamically generated target-specific selectors. Returns the discovered records and associates them with the successful selector.
• DomainKey: Queries the deprecated _domainkey endpoint to extract raw historical mail security configurations.

Cryptography & Security Policies

• CAA: Extracts the raw Certification Authority Authorization records. Crucially, it parses the tags (issue, issuewild, iodef) to automatically extract the domains of the Authorized CAs (e.g., letsencrypt.org) as new Domain nodes, and extracts violation reporting email addresses as new Email nodes.
• CERT: Extracts stored cryptographic certificates. It actively decodes the wire format to extract the base64 certificate data, and resolves the specific Certificate Type (e.g., PKIX, PGP, IPKIX) and cryptographic algorithm used.
• DNSKEY: Extracts public keys used for DNSSEC zone signing.
• DS: Extracts Delegation Signer (DS) records for the DNSSEC chain of trust.
• NSEC: Extracts Next Secure (NSEC/NSEC3) records used in DNSSEC. When properly parsed, these records can unintentionally disclose adjacent valid subdomains within the zone (zone walking) as well as explicitly list all DNS record types that exist for a given name, providing highly valuable targets and infrastructure details for further reconnaissance. Note that modern DNS providers (e.g., Cloudflare) actively mitigate this by dynamically generating fake NSEC records on the fly, rendering zone walking ineffective against protected infrastructure.
• SSHFP: Extracts SSH Public Key Fingerprints (SSHFP records).
• TLSA: Extracts Transport Layer Security Authentication (DANE) records.
• IPSECKEY: Extracts IPsec keying material (IPSECKEY records).
• HIP: Extracts Host Identity Protocol (HIP) cryptographic keys.

Service Discovery

• SRV: Actively brute-forces Service records using a built-in dictionary of common protocol prefixes (e.g., _sip._tcp, _ldap._tcp, _autodiscover._tcp). It parses discovered records to extract the target service hostnames, validating and returning them as new Domain nodes (assigning the SRV tag and evaluating scope).
• SVCB: Queries both SVCB and HTTPS binding records. It deeply parses the wire format to extract protocol parameters, including alpn and ech configs, and crucially extracts any embedded ipv4hint and ipv6hint addresses as new IP nodes.
• URI: Extracts Uniform Resource Identifier (URI) records and parses them to explicitly generate new URL endpoint properties.
• NAPTR: Extracts Naming Authority Pointer (NAPTR) records used in internet telephony. It deeply parses the record to extract services, regular expression targets (as URL properties), and validates the replacement field, returning it as a new Domain node.

Informational & Miscellaneous

• LOC: Extracts geographic Location (LOC) records. It deeply decodes the wire format to extract and mathematically calculate the exact latitude, longitude, altitude, and precision metrics, returning a formatted location property.
• HINFO: Extracts Host Information (HINFO) records. It parses the hardware and OS information, actively filtering out generic or spoofed values (e.g., Cloudflare masks), returning the verified CPU and OS details as distinct properties.
• RP: Extracts Responsible Person (RP) records. It parses the record to explicitly generate a new Email node for the administrator's contact, and extracts the reference TXT domain as a new Domain node (evaluating scope).