DNSRecon Reverse Lookup and Record Enumeration

312-50v13 By islever Editorial Last updated

Footprinting and Reconnaissance

Short answer

C The command dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std effectively performs reverse DNS lookups on the IP range and retrieves standard records including NS and MX.

Question

As a Certified Ethical Hacker, you are conducting a footprinting and reconnaissance operation against a target organization. You discover a range of IP addresses associated with the target using the SecurityTrails tool. Now, you need to perform a reverse DNS lookup on these IP addresses to find the associated domain names, as well as determine the nameservers and mail exchange (MX) records. Which of the following DNSRecon commands would be most effective for this purpose?
  1. dnsrecon -r 192.168.1.0/24 -n nsl.example.com -t axfr
  2. dnsrecon -r 10.0.0.0/24 -n nsl.example.com -t zonewalk
  3. dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std Correct Answer
  4. dnsrecon -r 162.241.216.0/24 -d example.com -t brt

Key Takeaways

The exam tests your ability to map specific DNSRecon flags (-r, -n, -t) to their functions, specifically distinguishing between standard enumeration (std) and brute force (brt).

This question tests the correct use of DNSRecon for performing reverse DNS lookups and enumerating standard records like NS and MX against a target IP range.

Common mistake: Candidates often select the 'brt' option, confusing standard record retrieval with dictionary-based brute forcing of subdomains.

Expert Analysis

Why the Answer Is Correct

The question requires two main actions: reverse DNS lookup on an IP range and identification of NS/MX records. Option C uses -r to specify the IP range 162.241.216.0/24, which triggers the reverse lookup. It specifies -n nsl.example.com as the nameserver to query. Crucially, it uses -t std, which performs standard enumeration including SOA, NS, A, AAAA, MX, and SRV records. This directly satisfies the requirement to find NS and MX records alongside the reverse lookups.

Why the Other Options Are Wrong

Option A (-t axfr) attempts a zone transfer, which is a distinct attack vector not mentioned in the prompt. Option B (-t zonewalk) is used to walk zones, which is also not the primary goal here. Option D (-t brt) performs brute-force domain enumeration using a dictionary file, which does not perform reverse DNS lookups on the specified IP range nor retrieve existing MX records from the target's configuration.

Community Comment Notes

Community consensus strongly supports C. As user pindinga1 noted, "The -t std option performs standard enumeration, which includes: Reverse lookups..." Another commenter emphasized that "the -t std is able to find out the requested information without the need of -t brt," highlighting the distinction between standard queries and brute-forcing.

Exam Strategy

Memorize the short flag descriptions for key tools. For DNSRecon, remember that -t std is your go-to for general record discovery (NS, MX, A), while -t axfr is for zone transfers and -t brt is for brute-forcing hostnames.

Frequently Asked Questions

What does the -t std flag do in DNSRecon?

It performs standard enumeration, querying for SOA, NS, A, AAAA, MX, and SRV records.

When should I use -t brt instead of -t std?

Use -t brt when you need to discover subdomains or hosts by guessing names against a dictionary, rather than querying existing records.

More 312-50v13 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. pindinga1 👍 3 Answered C
    ✅ C. dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std Explanation: The goal is to perform reverse DNS lookups, identify nameservers (NS), and find mail exchange (MX) records. The -r flag specifies an IP range for reverse DNS lookups. The -n flag specifies a nameserver to query. The -t std option performs standard enumeration, which includes: Reverse lookups on IP addresses (PTR records). Queries for MX records (Mail Exchange). Queries for NS records (Nameservers).
  2. bibibi 👍 2 Answered C
    the -t std is able to find out the requested information without the need of -t brt (brute force) enumeration.
  3. NikoTomas 👍 1 Answered C
    Answer: C Description of scan TYPES (-t option) from DNSRECON help: std: SOA, NS, A, AAAA, MX and SRV. brt: Brute force domains and hosts using a given dictionary. Further options: -n = name server (NS server) -d = domain -r = range of IP addresses to perform DNS reverse lookups on C) option contains “-n nsl.example.com” – i. e. NS server is already specified while the question asks to “determine the nameservers”, so it looks strange if we already have NS server determined in the answer. However, if we have one NS server defined, the command “-t std” can still find other NS servers (there are usually 2 or more) as well as MX records and other domain names as requested in question. I’ve tried this in Kali Linux for some domains and option “-t std” returned NS, MX and other records.
  4. MHafizC 👍 1 Answered C
    This can be achieved with standard query, in which you will get NS, MX, PTR records. So C is the answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide