dnsdumpster is a completely free tool for DNS reconnaissance. I will be using the web based interface but you can also clone the git repository .About A tool to perform DNS reconnaissance on target networks. Among the DNS information got from include subdomains, mx records, web application firewall detection and more fingerprinting and lookups. Here I simply check the DNS records that a certain university has.
The results show that we can pull different records as shown with the arrows. The IP block's location is also shown but this is just the beginning.
We are also able to see the nameserver records showing the DNS servers resolving the domain name.
Other records that can be found in the zone file such as the mx (mail exchange servers) can be found. These can be used if you are targeting mail servers in your penetration test.
Text records can sometimes have useful information including fingerprints, hashes, descriptions of network components, the security policy, vulnerabilities, comments left by a developer or network engineer, ownership information and much more
The host records are especially useful in showing the IP addresses and hostnames for different devices within the domain.This could help with targeting specific devices that are more useful to the network or simply give a penetration tester enough IP addresses to scan for vulnerabilities and open ports.
Finally, dnsdumpster has a graphical mapping tool that allows the penetration tester to see how the subdomains are linked with each other almost like a trace route result.