Which DNSRecon Command Performs Reverse DNS on an IP Range?

312-50v12 By islever Editorial Last updated

Foot Printing and Reconnaissance

Short answer

C Dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std performs reverse DNS across the IP range and standard enumeration for NS and MX records.

Question

As a Certified Ethical Hacker, you are conducting a footprinting and reconnaissance operation against a target organization. You discover a range of IP addresses associated with the target using the SecurityTrails tool. Now, you need to perform a reverse DNS lookup on these IP addresses to find the associated domain names, as well as determine the nameservers and mail exchange (MX) records. Which of the following DNSRecon commands would be most effective for this purpose?
  1. dnsrecon -r 192.168.1.0/24 -n nsl.example.com -t axfr
  2. dnsrecon -r 10.0.0.0/24 -n nsl.example.com -t zonewalk
  3. dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std Correct Answer
  4. dnsrecon -r 162.241.216.0/24 -d example.com -t brt

Key Takeaways

The exam tests mapping DNSRecon switches to the intended reconnaissance task, and the trap is picking a zone-transfer or brute-force mode because it sounds more thorough than -t std.

DNSRecon reverse DNS on an IP range uses -r with standard enumeration, and dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std is the option that matches that workflow. This page confirms why -t std is effective for PTR, NS, and MX discovery while the other query types do not fit.

Common mistake: A frequent wrong answer is -t axfr, since a zone transfer sounds like it would reveal all records, but AXFR is not a reverse DNS sweep and depends on a misconfigured authoritative server.

Expert Analysis

Why the Answer Is Correct

Option C is the only command that combines -r 162.241.216.0/24, which tells DNSRecon to walk the discovered IP range for reverse DNS, with -n nsl.example.com, a nameserver to query, and -t std, the standard enumeration type. In DNSRecon, -t std performs broad standard record enumeration and is the appropriate mode for collecting domain-name context, nameserver data, and MX records from a range. The command uses the actual target range shown in the scenario rather than an unrelated private range. Therefore C matches both the syntax and the reconnaissance purpose described in the question.

Why the Other Options Are Wrong

Option A uses -t axfr, which attempts an authoritative zone transfer rather than a reverse DNS sweep of the discovered range, and it also targets 192.168.1.0/24 instead of the scenario range. Option B uses -t zonewalk, a DNSSEC NSEC walking mode, which is unrelated to finding PTR, NS, and MX records for a public IP range. Option D uses -t brt with -d example.com, so it switches DNSRecon into brute-force name discovery rather than standard reverse lookup and enumeration. None of those modes provide the requested combination of reverse DNS resolution plus nameserver and MX collection.

Community Comment Notes

smoce captures the practical point that -t std covers standard enumeration, noting it "includes fetching PTR, NS, and MX records." brrbrr expands the type list to "SOA, NS, A, AAAA, MX and SRV," which reinforces that std is broader than a single record query. insaniunt simply reads -t std as a standard query, consistent with DNSRecon command syntax. The repeated C votes are not evidence by themselves, but they align with the option that pairs -r on the discovered range with standard DNS enumeration.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Memorize DNSRecon's -t modes by task: std for standard record enumeration, axfr for zone transfers, zonewalk for DNSSEC walking, and brt for brute forcing. When the stem says reverse DNS on an IP range, look for -r plus -t std and a nameserver supplied with -n.

Frequently Asked Questions

Why is -t axfr not the best choice for reverse DNS on an IP range?

AXFR attempts a full zone transfer from a nameserver and is not a reverse lookup for IP addresses; it usually fails unless the server is misconfigured.

What does dnsrecon -t std return in this scenario?

It runs standard enumeration and can return SOA, NS, A, AAAA, MX, SRV, and PTR data depending on the target and nameserver.

More 312-50v12 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. smoce 👍 6 Answered C
    The std type is often used for standard enumeration, which includes fetching PTR, NS, and MX records.
  2. [Removed] 👍 3
    Could anyone verify the correctness of this answer
  3. insaniunt 👍 2 Answered C
    C. "-t std": Specifies the type of DNS query to perform. In this case, it's a standard query
  4. brrbrr 👍 1 Answered C
    -t TYPE, --type TYPE Type of enumeration to perform. Possible types: std: SOA, NS, A, AAAA, MX and SRV.
  5. tow 👍 1 Answered C
    The std type is often used for standard enumeration, which includes fetching PTR, NS, and MX records.C
Show 2 more comments
  1. przemyslaw1 👍 2 Answered C
    C. -t std
  2. LeongCC 👍 1 Answered C
    Is C -std

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide