I'm trying to understand how Metasploit's DNS BailiWicked Host Attack module works. One of the required module options is a "reconnaissance" nameserver (option RECONS).
What I understand from the source code is that the the recon server is used to find the authoritative nameserver for the domain we are spoofing. But why can't the target name server be used for this? Is it so that the target host doesn't get cached during the lookup?