python7427 ython

When building out network enumeration tooling, understanding how domain structures map out is a core skill for any security enthusiast or developer. In this post, we will look at a simple, recursive DNS exploration script written in Python using the dnspython library.
PrerequisitesTo run this script locally or inside a mobile terminal environment like Termux, you will need the dnspython package installed:

pip install dnspython
The Script Code
Here is the complete script used for dictionary-based subdomain enumeration and reverse DNS lookups:
import dns
import dns.resolver
import socket

domains = {}
subs = "dns_search.txt"

res = dns.resolver.Resolver()
res.nameservers = ["8.8.8.8"]
res.port = 53

domain = "google.com"
nums = True

def ReverseDNS(ip):
try:
result = socket.gethostbyaddr(ip)
return [result[0]]+result[1]
except socket.herror:
return []

def DNSRequest(domain):
ips = []
try:
result = res.resolve(domain)
if result:
addresses = [a.to_text() for a in result]
if domain in domains:
domains[domain] = list(set(domains[domain]+addresses))
else:
domains[domain] = addresses
for a in addresses:
rd = ReverseDNS(a)
for d in rd:
if d not in domains:
domains[d] = [a]
DNSRequest(d)
else:
domains[d] = [a]
except (dns.resolver.NXDOMAIN,dns.exception.Timeout):
return []
return ips

def HostSearch(domain,dictionary,nums):
successes = []
for word in dictionary:
d = word+"."+domain
DNSRequest(d)
if nums:
for i in range (0,10):
s = word+str(i)+"."+domain
DNSRequest(s)

dictionary = []
with open(subs,"r") as f:
dictionary = f.read().splitlines()

HostSearch(domain,dictionary,nums)

for domain in domains:
print("%s:%s" % (domain, domains[domain]))
How It Works
Custom Resolver Configuration: The script instantiates a custom resolver pointing explicitly to Google's public DNS nameserver (8.8.8.8) on port 53.
Dictionary Iteration & Numeric Append: It reads a wordlist (dns_search.txt) and combines each word with the target domain. If nums = True, it additionally appends digits 0 through 9 to maximize surface coverage.

Recursive Reverse Lookup: When a valid A record is resolved, the script performs a reverse DNS lookup (PTR) on the resulting IP address, feeding any discovered hostnames back into the exploration loop.