$loading...
Copy-ready dig, host, nslookup, and dnsrecon commands for querying DNS records, attempting zone transfers, brute-forcing subdomains, and reverse-resolving netblocks during authorized testing. (45 payloads)
dig example.com A +shortdig example.com AAAA +shortdig example.com MX +shortdig example.com NS +shortdig example.com TXT +shortdig example.com SOA +multilinedig example.com CAA +shortdig example.com ANY @8.8.8.8host -a example.comhost -t mx example.com 1.1.1.1host 93.184.216.34nslookup -type=any example.comnslookup -type=mx example.com 8.8.8.8nslookup -debug example.comhost -l example.com ns1.example.comdig AXFR example.com @ns1.example.comfor ns in $(dig +short NS example.com); do dig AXFR example.com @$ns; donedig IXFR=2024010101 example.com @ns1.example.comdnsrecon -d example.com -t axfrfierce --domain example.comdig AXFR internal.example.com @10.0.0.53dnsrecon -d example.com -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t brtgobuster dns -d example.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 50 -idnsx -d example.com -w wordlist.txt -r resolvers.txt -a -resp -o resolved.txtpuredns bruteforce all.txt example.com -r resolvers.txt --resolvers-trusted trusted.txtfor sub in www mail dev api vpn staging admin git jenkins; do dig +short $sub.example.com; donedig +short '*.example.com'dig -x 93.184.216.34 +shortdig +short PTR 34.216.184.93.in-addr.arpafor ip in 93.184.216.{1..254}; do echo "$ip $(dig +short -x $ip)"; done | grep -v '^.* $'dnsrecon -r 93.184.216.0/24nmap -sL 93.184.216.0/24prips 93.184.216.0/24 | hakrevdns -t 50dig +short TXT example.com | grep -i spfdig +short TXT _dmarc.example.comdig +short TXT selector1._domainkey.example.comdig +short TXT default._bimi.example.comdig +short SRV _autodiscover._tcp.example.comdig +short TXT _mta-sts.example.com && dig +short TXT _smtp._tls.example.comdig example.com DNSKEY +shortdig example.com +dnssecdig nonexistent.example.com NSEC +shortnsec3walker example.comdig example.com A @ns1.example.com +norecursedig version.bind CHAOS TXT @ns1.example.comLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 45 DNS Enum payloads for testing DNS Enumeration vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or use the DNS Record Lookup to apply them interactively. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all DNS Enum payloads are completely free, with no account required. Everything runs in your browser.