1. You found the address. What should you check next?
An address book can tell you where a store is. Checking whether it is open takes another step. DNS works much the same way: it returns data about a name. Website availability and sign-in permissions need their own checks.
The example below is made-up lab data, not a query we ran. example.test is an example name and 192.0.2.10 is a documentation address. Use your authorized lab data when practicing.
Read three settings first
A gives the IPv4 address for www. CNAME makes shop an alias for www. MX names mail as a mail server; 10 is its preference value, with lower numbers preferred.
Record these as DNS settings. Test web access, mail delivery, and administrative rights separately within the agreed boundaries.
www.example.test. A 192.0.2.10
shop.example.test. CNAME www.example.test.
example.test. MX 10 mail.example.test.2. Who looks up the answer? Who maintains it?
DNS enumeration means querying different record types and organizing the names, addresses, and server clues you receive. Record who you asked and when so you can compare results.
A recursive resolver looks up answers for you and may cache them. An authoritative server maintains the official data for a zone. A zone is a portion of DNS data managed by a set of authoritative servers; it may cover only part of a domain.
Traditional DNS uses UDP or TCP port 53. TCP also carries ordinary queries. Other DNS transports may be used in a particular environment. DNS concepts · Messages and records
This is a guide to reading a response. An answer may come from cache, or you may need another query.
- Choose the target
Record the DNS server, name, and record type.
- Read the response
Check the status, then the Answer and Authority sections.
- Record the setting
Save the returned address, alias, or other fields.
- Test services separately
Check web access, mail delivery, and sign-in rights separately.
3. Which field answers your question?
A name can have several record types. Choose the type that answers your question. A asks for IPv4 addresses; AAAA asks for IPv6 addresses. AAAA specification
| Type | What it tells you |
|---|---|
| A / AAAA | IPv4 / IPv6 addresses for a name. |
| CNAME | An alias pointing to another name; follow that name to continue. |
| MX | Mail server hostnames and preference values, rather than personal mailboxes. |
| NS | Authoritative name servers for a zone. |
| TXT | Text such as domain verification data or mail policy. |
| SOA | Zone management data, including a serial number and synchronization timers. |
| PTR | A name for a reverse IP lookup; cross-check it with forward records. |
4. What does an empty answer mean?
Read the whole response before deciding what is missing. NOERROR is a response status. An empty Answer section still requires a look at Authority and any aliases: the response may mean that the requested data is absent, or it may point you to another server.
| Response | What to record |
|---|---|
| NXDOMAIN | The response says a name does not exist. With a CNAME chain, check which name it refers to. |
| NODATA | The name exists, but the requested type has no data. This is a response interpretation, not a separate error code. |
| SERVFAIL | The server had a problem completing resolution. Save the response and investigate. |
| Timeout | No response arrived within the wait period. The cause still needs investigation. |
Optional: an empty NOERROR answer may be a referral
NODATA often appears as NOERROR without an answer of the requested type. An SOA in Authority and the rest of the response help you identify it. A referral may instead list NS records for servers to ask next.
Check the status, Answer, Authority, alias chain, and server together. Sometimes another query is needed to tell which situation applies. RFC 2308
Why can the same name return different answers?
TTL sets how long a record may be cached. Cached data, remaining TTL, different internal and external views, and the server you ask can all affect the result.
Save the time, server, name, type, and full response. Use a new record when you change networks or servers so that the conditions stay clear.
5. Try one lookup in your own lab
Website supplement: these optional commands are separate from the made-up output above. Use a computer with dig and an authorized DNS lab server hosting your test zone. Agree on the target, record types, time, query volume, and stop conditions first.
192.0.2.53 is only an example DNS address. Replace it with your authorized host. These commands have not been run here, and your results are left for you to record.
In your local terminal, ask for one type at a time
The value after @ selects the server. A or AAAA selects the record type. Save the full response after each command before continuing.
dig @192.0.2.53 www.example.test A
dig @192.0.2.53 www.example.test AAAARead the response, then write your observation
Find status and check that QUESTION contains the intended name and type. Review ANSWER, AUTHORITY, SERVER, query time, and TTL. Full output helps distinguish referrals from missing data.
If A returns an address and a complete reading of the AAAA response shows NODATA, record: “This server returned an IPv4 address and no AAAA data for this name in these queries.” To check website availability, test the corresponding web service within your authorization.
Keep a de-identified record when you finish. This exercise queries DNS; it requires no DNS configuration changes.
6. Manage a lookup and a zone copy separately
AXFR transfers the complete contents of one zone to another DNS server. Think of copying one zone’s address book. The full data of a delegated child zone is managed separately. AXFR
Confirm authorization separately for ordinary queries and AXFR tests. This lesson explains transfers without probing third parties. Restrict transfer recipients, use appropriate authentication, and limit access to recursion and cached answers.
Optional: settings to review in BIND
Review allow-transfer, allow-recursion, and allow-query-cache, and use authentication such as TSIG where appropriate. Check the installed version, configuration level, and effective settings. This lesson assumes no common default across all versions. ISC BIND reference
Optional: cache clues and DNSSEC
Cache snooping uses cached responses to infer which names may have been queried. Shared caches and preloading affect those clues; attributing activity to a person requires other evidence.
DNSSEC uses signatures to support origin authentication and integrity checks. Keeping query contents private is a separate job. Signed zones using NSEC may also reveal relationships between names. Manage public records and access to resources separately. DNSSEC
7. One small check
The same DNS server returns 192.0.2.10 for www.example.test A and NODATA for AAAA. In one or two sentences, what have you confirmed? What would you check to find out whether the website opens?
This teaching check is awaiting your response. The page neither submits an answer nor changes your understanding status. The next core concept is M04-03 FTP enumeration.
Concept Q&A
Pending: related questions will be edited into anonymous teaching notes when available.