Building a Lightweight DNS Exploration Tool in Python

When building out network enumeration tooling, understanding how domain structures map out is a core skill for any security enthusiast or developer. In this post, we will look at a simple, recursive DNS exploration script written in Python using the dnspython library.

PrerequisitesTo run this script locally or inside a mobile terminal environment like Termux, you will need the dnspython package installed:


pip install dnspython

The Script Code

Here is the complete script used for dictionary-based subdomain enumeration and reverse DNS lookups:

import dns

import dns.resolver

import socket

domains = {}

subs = "dns_search.txt"

res = dns.resolver.Resolver()

res.nameservers = ["8.8.8.8"]

res.port = 53

domain = "google.com"

nums = True

def ReverseDNS(ip):

try:

result = socket.gethostbyaddr(ip)

return [result[0]]+result[1]

except socket.herror:

return []

def DNSRequest(domain):

ips = []

try:

result = res.resolve(domain)

if result:

addresses = [a.to_text() for a in result]

if domain in domains:

domains[domain] = list(set(domains[domain]+addresses))

else:

domains[domain] = addresses

for a in addresses:

rd = ReverseDNS(a)

for d in rd:

if d not in domains:

domains[d] = [a]

DNSRequest(d)

else:

domains[d] = [a]

except (dns.resolver.NXDOMAIN,dns.exception.Timeout):

return []

return ips

def HostSearch(domain,dictionary,nums):

successes = []

for word in dictionary:

d = word+"."+domain

DNSRequest(d)

if nums:

for i in range (0,10):

s = word+str(i)+"."+domain

DNSRequest(s)

dictionary = []

with open(subs,"r") as f:

dictionary = f.read().splitlines()

HostSearch(domain,dictionary,nums)

for domain in domains:

print("%s:%s" % (domain, domains[domain]))

How It Works

Custom Resolver Configuration: The script instantiates a custom resolver pointing explicitly to Google's public DNS nameserver (8.8.8.8) on port 53.

Dictionary Iteration & Numeric Append: It reads a wordlist (dns_search.txt) and combines each word with the target domain. If nums = True, it additionally appends digits 0 through 9 to maximize surface coverage.


Recursive Reverse Lookup: When a valid A record is resolved, the script performs a reverse DNS lookup (PTR) on the resulting IP address, feeding any discovered hostnames back into the exploration loop.