DNSai for Reconnaissance
Reconnaissance is the part of an engagement where time disappears. This short overview covers how much of a domain's external footprint can be mapped from public sources before the engagement formally starts — including subdomains pulled from Certificate Transparency logs.
What you'll take away
- Map a domain's external footprint from public records alone.
- Certificate Transparency logs surface subdomains that never appear in a zone transfer.
- CT-sourced names include hosts that no longer resolve — that is expected, and useful history.
- Mail routing, nameservers and hosting come out of the same pass.
- Walk into the engagement with the map already drawn.
The footprint you can see from outside
A domain's public DNS describes more of its perimeter than most organisations realise: where the website is hosted, who runs the mail, which nameservers are authoritative, which certificate authorities are permitted to issue, and which third parties are authorised to send email.
Collected in one pass, that is the skeleton of an external attack surface map — and it costs nothing but public queries.
Certificate Transparency as a subdomain source
Every publicly trusted TLS certificate issued for a domain is logged to Certificate Transparency. Because certificates are usually issued per hostname, those logs become a record of subdomains — including internal-sounding names like staging, vpn and admin that were never meant to be advertised.
An important caveat the video is explicit about: CT-sourced names are historical. A name appearing in the logs means a certificate was issued for it at some point, not that it resolves today. Non-resolving results are returned deliberately rather than filtered out, because knowing a host once existed is itself a finding worth chasing.
Where the map takes you
The output is a starting position, not a conclusion. Subdomains worth probing, a mail path worth testing for spoofability, hosting providers worth checking for known issues — all identified before the first active request is sent, which is how the noisy part of an engagement gets kept short.
Questions
- Why do some subdomains in the results not resolve?
- They come from Certificate Transparency logs, which record certificates that were issued rather than hosts that are currently live. Non-resolving names are returned on purpose as historical footprint.
- Is subdomain enumeration active or passive?
- The Certificate Transparency source is passive — the logs are public and queried independently of the target.
Try what's in the video
More DNSai videos
← Back to the Media CenterAll videos, guides and brand resources