The ask
Paul asked whether the Domain Recon tool could show what DNSDumpster shows for a domain, with a bit more information, and pointed at his own domain as the example.
What changed
- New section, Hosts, addresses and ownership. Host names come from Hackertarget’s passive dataset, the same source behind DNSDumpster, and every address is looked up for its AS number, network name, netblock, country and reverse DNS. The domain’s own addresses, its mail hosts and its name server hosts are all included.
- New section, All TXT records at the domain. Every TXT value, not only the mail ones, so site and service verification records are visible too.
- AS number, network name, netblock and country come from Team Cymru’s public IP to ASN mapping, asked through the resolver the user already picks, and reverse DNS comes from that same resolver. No new third party is added to the request beyond the resolver and the passive host dataset.
- The tool script moved out of the page into a versioned asset, pn-tools/assets/domain-recon.8b2b56fd3a6e.js, the way the SPF and QR tools already work. The stored page dropped from 42 KB to 13 KB.
- The page copy gained the two new section rows, a paragraph on how to read the host list, an honest limit for port and service scanning, and a note that host names are not brute forced.
- The privacy note now names Hackertarget, says it is rate limited, and asks that this be used on a domain you own or are responsible for.
How
I ran DNSDumpster against the domain in a browser first to see what it actually returns, then tested which public sources a browser-only tool can reach, then extended the tool script and checked every figure against DNSDumpster’s own output.
What worked, what didn’t
- Hackertarget’s hostsearch is the dataset DNSDumpster is built on, it needs no key, and it allows browser requests. Team Cymru publishes an IP to ASN mapping in DNS, so it works through the resolver already in use. Certificate transparency was not usable: crt.sh answered HTTP 502 and sends no CORS header.
- The tool reproduces DNSDumpster’s figures for the same domain, and finds more than its free view. Where DNSDumpster reported the Cloudflare hosts as AS13335 on 172.64.145.0/24 and 162.159.128.0/19, the web host as AS31898 on 198.57.128.0/19, and the mail host as AS8075 on 52.96.0.0/12, this tool reports the same numbers. It also reports the apex address, a mail relay on AS63949 at Akamai, and real reverse DNS names, none of which appeared in DNSDumpster’s free listing.
- 44 automated checks pass, including the ip6.arpa nibble reversal checked against a published value rather than against another copy of the same code.
- A real bug, caught before anything was published. The first build reused the reverse DNS name for the Cymru lookup, so every query asked for a name ending in in-addr.arpa.origin.asn.cymru.com. Reverse DNS worked and the AS column was silently empty. The browser’s network log showed the doubled suffix. The two names are now built separately and a regression test fails if the Cymru name ever contains arpa again.
- What this still cannot do. The service and banner columns on DNSDumpster come from its own scanning database, not from DNS, and a browser cannot scan ports. Address rows are capped at 15 and host names are never brute forced, so a host that has never appeared in public data stays invisible here. Both limits are stated on the page.
Change record
| Harness | opencode |
| Date | 2026-10-12 16:18 |
| Latest snapshot | 20261012-161837 |
| Undo this session | ops/rollback.sh --git c6268ec |
Commits