DNS servers can provide detailed information about a target organization's servers. What is the primary value of querying DNS in reconnaissance?

• A. To crack passwords
• B. To brute-force
• C. To modify DNS records
• D. To gather infrastructure details

Answer: (D)

Querying DNS during reconnaissance is about mapping the target’s external footprint by collecting information that DNS stores about domains, hosts, and services. DNS records reveal which machines exist for a domain (A records for host IPs, CNAMEs for aliases), where mail is handled (MX), which servers administer the zone (NS), and various policies or verifications (TXT, SPF). This public data lets you build a picture of the organization’s infrastructure, how its services are structured, and where potential exposure or misconfigurations might lie. It’s about understanding the layout of the target’s internet-facing assets, not about cracking passwords, brute-forcing credentials, or altering DNS records.