Which Unix-like command is commonly used for DNS reconnaissance to gather information about name servers and mail exchanges?

Which Unix-like command is commonly used for DNS reconnaissance to gather information about name servers and mail exchanges?

• A. RCPT TO
• B. dig command
• C. nslookup
• D. Showmount

Answer: (B)

When doing DNS reconnaissance, you want a tool that can query DNS records and reveal how a domain is structured in terms of where it’s delegated and how email is handled. The dig command is ideal for this because it lets you request specific record types and see the exact data returned. For gathering information about name servers, you’d query for NS records to identify the domain’s authoritative name servers. For mail handling, you’d query for MX records to discover the mail exchangers used by the domain. Dig also supports targeting a particular DNS server and offers concise output with +short, which makes it easy to parse in scripts during an assessment. For example, dig NS example.com shows the domain’s name servers, and dig MX example.com reveals the mail servers. The other options aren’t as suitable: an SMTP command like RCPT TO is part of mail transfer, not DNS lookups; Showmount relates to NFS mounting and isn’t used for DNS; nslookup can perform similar queries but is less flexible and scripting-friendly than dig.

When doing DNS reconnaissance, you want a tool that can query DNS records and reveal how a domain is structured in terms of where it’s delegated and how email is handled. The dig command is ideal for this because it lets you request specific record types and see the exact data returned. For gathering information about name servers, you’d query for NS records to identify the domain’s authoritative name servers. For mail handling, you’d query for MX records to discover the mail exchangers used by the domain. Dig also supports targeting a particular DNS server and offers concise output with +short, which makes it easy to parse in scripts during an assessment. For example, dig NS example.com shows the domain’s name servers, and dig MX example.com reveals the mail servers. The other options aren’t as suitable: an SMTP command like RCPT TO is part of mail transfer, not DNS lookups; Showmount relates to NFS mounting and isn’t used for DNS; nslookup can perform similar queries but is less flexible and scripting-friendly than dig.