I've seen there are programs for pentesting, such as FOCA, that provide tools for DNS snooping. The part I don't understand is how can we know the DNS server an organization is using.

Also, from what I understand, if xyz.example uses xyz.dns server, it means that that site asks that DNS server for the IP's of the domain names it's trying to get to. However, xyz.example it's a website so I don't understand how can that provide info about what sites are visiting the members of that organization. I think it's not that straightforward and what you're doing is guessing that if the organization website is using a particular DNS server, then the other servers, PC's, etc. are probably using the same DNS server, but I'd like someone to explain this in more detail.


Standard DNS queries have a destination port of 53 and use UDP. If you are monitoring outside of the gateway, you will see the DNS server address in the traffic. If you are inside the network, you will generally only see the gateway address in the traffic under most common auto configurations (although individual machines may explicitly specify).

However, monitoring DNS queries doesn't require knowing the DNS server being used. All that's needed is to watch UDP port 53 traffic.

For example, ping mit.edu:

DNS for ping of mit.edu

  • thanks for the answer. However I don't see how this tool is monitoring the network, like wireshark does, that's the thing I don't understand. My guess is that this tool probably uses nmap to do so: nmap.org/book/host-discovery-dns.html @user10216038 – Johnny Mar 17 at 19:07
  • 2
    The sample I pasted was from Wireshark. – user10216038 Mar 19 at 3:35
  • does this answer my question?@schroeder @rory-alsop I ask:"...how can we know the DNS server an organization is using." and I add that even if I know the DNS of a domain, how can I know if the whole organization is actually using that server. This answer talks about monitoring the network using Wireshark, not the tool I'm talking about. The answer you deleted is the explanation to my question answered by the creator of the tool in a conference, which is in spanish, but I can provide the link if you want to check it out. Can you explain how this is "an excuse to accept an own post"? – Johnny Mar 21 at 11:15
  • Standard DNS queries have a destination port of 53 and use both UDP and TCP. Also ping is not a troubleshooting tool, use dig instead which does just DNS, which is what is needed to troubleshoot DNS. – Patrick Mevzek Mar 26 at 0:23

how can we know the DNS server an organization is using.

The question is not very clear. You just need to find one of the domain used by the organization. You can do that in many ways:

  • a search engine obviously
  • looking at Certificate Transparency Logs you can may find certificates with company name, and tied to some domain
  • using RIR whois database, searching on company names, you can find IP blocks, and from there, either with reverse DNS, or looking at emails found or again searching in a search engine for the IP blocks you can find domain names.

You have even more options if you can be on some active paths, like changing recursive nameservers to gather DNS data, etc.

Once you get the domain name, any whois or DNS query will show you which nameservers are used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.