Kali Linux Day 23 — Fierce DNS Reconnaissance Tutorial 2026

This article teaches DNS reconnaissance using Fierce, a tool that attempts zone transfers and brute-forces subdomains to map target infrastructure. Zone transfers—when misconfigured—expose the complete DNS record set including internal hostnames, IPs, mail servers, and dev environments in a single query. The article matters because it demonstrates that active DNS querying reveals infrastructure details that passive tools like Subfinder and certificate transparency logs miss, and it provides a structured workflow combining passive and active recon techniques.

• Zone transfer misconfiguration exposes complete infrastructureA DNS zone transfer (AXFR) is a legitimate secondary nameserver synchronisation mechanism that becomes dangerous when the primary is misconfigured to allow transfers from any IP rather than only authorised secondaries. A successful zone transfer returns every DNS record in the domain—internal hostnames, internal IP addresses (RFC1918 ranges), mail servers, VPN gateways, dev/staging environments, and database servers—handing an attacker a complete network map. The article notes this misconfiguration is still common in internal DNS servers, small hosting providers, and legacy corporate DNS, part
• Fierce attempts zone transfer before brute forcingThe core Fierce command `fierce --domain target.com` performs three actions: discovers nameservers via NS record queries, attempts AXFR zone transfer against each nameserver, and conducts wordlist-based subdomain brute forcing if zone transfer fails. The article emphasises that zone transfer attempts are the most efficient recon operation when successful—returning complete infrastructure in a single query—making zone transfer the primary technique before falling back to brute forcing.
• The --traverse flag discovers reverse DNS infrastructureThe `--traverse` option checks IP addresses adjacent to found subdomains for reverse DNS (PTR) records. For example, if `dev.target.com` resolves to `10.0.0.5`, running `--traverse 5` checks `10.0.0.1` through `10.0.0.10` for PTR records. This discovers internal servers that have reverse DNS configured but no forward A record published—common for internal infrastructure where administrators set up reverse DNS without intending external publication.
• Active DNS recon creates nameserver logs and requires scopeUnlike passive reconnaissance, active DNS queries using Fierce cause the attacker's IP address to hit the target's nameservers where every query is logged. The article stresses that active DNS recon must occur within explicit scope; most bug bounty programs permit subdomain enumeration but not active port scanning. Operators must clarify scope definitions before running Fierce, as DNS reconnaissance differs from passive OSINT in its detectability.
• Complete workflow layers passive tools then active scanningThe article describes a five-phase workflow: Phase 1 uses Subfinder and certificate transparency (crt.sh) passively without contacting target nameservers; Phase 2 runs Fierce for zone transfer attempts and active brute forcing; Phase 3 deduplicates combined results; Phase 4 uses httpx to identify live web services; Phase 5 prioritises high-value targets like admin panels and developer tools. This passive-first approach allows understanding of scope before IP addresses appear in nameserver logs.
• Critical DNS record types reveal infrastructure and entry pointsThe article identifies key DNS records for reconnaissance: A records map domains to IPv4 addresses; AAAA records map to IPv6; MX records reveal mail servers that often bypass front-end security; NS records identify nameserver targets for zone transfer; CNAME records expose internal naming conventions; TXT records leak SPF, DMARC, and verification tokens revealing technology stack. MX records are particularly valuable as they can provide direct access to mail servers circumventing perimeter security.
• Zone transfer findings receive Medium-to-High severity ratingsZone transfer misconfiguration is documented as CWE-16 (Configuration) with severity dependent on revealed content. External DNS zones showing only public-facing hosts rate low severity; zones revealing internal IP addresses, internal hostnames, and infrastructure naming conventions rate High-to-Critical because they provide a complete network map that would otherwise require weeks of scanning to construct. The fix involves restricting AXFR queries to authorised secondary nameserver IPs only.
• zonetransfer.me provides legal zone transfer practiceThe article identifies zonetransfer.me as a deliberately vulnerable legal practice target maintained specifically for zone transfer testing. The domain intentionally contains dozens of records including internal RFC1918 IP addresses, HR hostnames, finance server names, and realistic internal infrastructure labels, allowing practitioners to observe complete zone transfer output without legal risk before testing actual targets.

Bottom line: Fierce discovers infrastructure details missed by passive tools through zone transfer attempts and active DNS brute forcing, with the --traverse flag revealing additional internal servers via reverse DNS; operators must confirm scope before running active queries and should combine Fierce results with passive enumeration (Subfinder, crt.sh) for comprehensive DNS reconnaissance that identifies internal networks, mail servers, and development infrastructure in single queries when zone transfers su