Which DNSRecon Command Performs Reverse DNS on an IP Range?
As a Certified Ethical Hacker, you are conducting a footprinting and reconnaissance operation against a target organization. You discover a range of IP addresses associated with the target using the SecurityTrails tool. Now, you need to perform a reverse DNS lookup on these IP addresses to find the associated domain names, as well as determine the nameservers and mail exchange (MX) records. Which of the following DNSRecon commands would be most effective for this purpose?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests mapping DNSRecon switches to the intended reconnaissance task, and the trap is picking a zone-transfer or brute-force mode because it sounds more thorough than -t std.
DNSRecon reverse DNS on an IP range uses -r with standard enumeration, and dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std is the option that matches that workflow. This page confirms why -t std is effective for PTR, NS, and MX discovery while the other query types do not fit.
A frequent wrong answer is -t axfr, since a zone transfer sounds like it would reveal all records, but AXFR is not a reverse DNS sweep and depends on a misconfigured authoritative server.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C is the only command that combines -r 162.241.216.0/24, which tells DNSRecon to walk the discovered IP range for reverse DNS, with -n nsl.example.com, a nameserver to query, and -t std, the standard enumeration type. In DNSRecon, -t std performs broad standard record enumeration and is the appropriate mode for collecting domain-name context, nameserver data, and MX records from a range. The command uses the actual target range shown in the scenario rather than an unrelated private range. Therefore C matches both the syntax and the reconnaissance purpose described in the question.Why the Other Options Are Wrong
Option A uses -t axfr, which attempts an authoritative zone transfer rather than a reverse DNS sweep of the discovered range, and it also targets 192.168.1.0/24 instead of the scenario range. Option B uses -t zonewalk, a DNSSEC NSEC walking mode, which is unrelated to finding PTR, NS, and MX records for a public IP range. Option D uses -t brt with -d example.com, so it switches DNSRecon into brute-force name discovery rather than standard reverse lookup and enumeration. None of those modes provide the requested combination of reverse DNS resolution plus nameserver and MX collection.Community Comment Notes
smoce captures the practical point that -t std covers standard enumeration, noting it "includes fetching PTR, NS, and MX records." brrbrr expands the type list to "SOA, NS, A, AAAA, MX and SRV," which reinforces that std is broader than a single record query. insaniunt simply reads -t std as a standard query, consistent with DNSRecon command syntax. The repeated C votes are not evidence by themselves, but they align with the option that pairs -r on the discovered range with standard DNS enumeration.Official Reference
Exam Strategy
Memorize DNSRecon's -t modes by task: std for standard record enumeration, axfr for zone transfers, zonewalk for DNSSEC walking, and brt for brute forcing. When the stem says reverse DNS on an IP range, look for -r plus -t std and a nameserver supplied with -n.
Frequently Asked Questions
Why is -t axfr not the best choice for reverse DNS on an IP range?
AXFR attempts a full zone transfer from a nameserver and is not a reverse lookup for IP addresses; it usually fails unless the server is misconfigured.
What does dnsrecon -t std return in this scenario?
It runs standard enumeration and can return SOA, NS, A, AAAA, MX, SRV, and PTR data depending on the target and nameserver.