DNS Reconnaissance Check: What StackShield Tests

What this check runs

This check performs DNS reconnaissance against your domain, in the style of dnsrecon: it enumerates records, attempts zone transfers, and gathers the DNS-level detail an attacker collects before targeting you. It is mapping what your DNS reveals about your infrastructure.

Why it matters

DNS is a public map of your infrastructure that most teams never review for how much it gives away. Reconnaissance surfaces the subdomains you run, the services behind them, mail and hosting providers, and sometimes internal naming conventions that hint at systems not meant to be public.

The most serious single finding is an open zone transfer, where a misconfigured nameserver hands over your entire DNS zone to anyone who asks. That is a complete list of your hosts and services in one request, a reconnaissance gift. Beyond that, exposed subdomains widen the attack surface an attacker considers, and dangling ones enable takeover.

What the findings mean

Findings describe what your DNS discloses: enumerable subdomains, an open zone transfer if present, and records that reveal more than intended. Most are information disclosure, but they shape how efficiently an attacker can target you.

The remedy is disabling zone transfers to untrusted hosts, reviewing which subdomains need to be public, and applying the broader DNS hardening in the DNS security guide.

See the step-by-step remediation: how to fix this.