Can command-line DNS queries replace a zone export?
No. dig, nslookup and Resolve-DnsName retrieve answers for selected names and types. They do not enumerate every record in an authoritative DNS zone. Use them to verify known hosts or supplement an authorized export, and label the source and collection time. For a complete configured inventory, begin with the DNS provider's zone export instructions.
Create hosts.txt with one hostname per line, using names you own or are authorized to assess:
example.com
www.example.com
api.example.com
The following read-only examples query A records for these named hosts, then save a three-column CSV understood by the Recon.ph workspace. 192.0.2.0/24 addresses below are documentation examples, not live findings.
Linux: dig with a scoped host list
On Ubuntu, install dnsutils if dig is unavailable. Save hosts.txt alongside your commands, then run:
printf 'hostname,type,value\n' > inventory.csv
while IFS= read -r host || [ -n "$host" ]; do
case "$host" in ''|\#*) continue ;; esac
dig +short "$host" A | awk -v h="$host" \
'/^[0-9]+(\.[0-9]+){3}$/ {print h ",A," $0}' >> inventory.csv
done < hosts.txt
Use only hostnames you intend to investigate. Keep the input file for provenance. The result is a selected-host A-record observation—not evidence of absent hostnames. Some names may return no A answer, and a CNAME chain may be visible only through additional queries. The regular expression selects IPv4-looking lines rather than alias text; review the output before relying on it.
To investigate a single CNAME or MX answer manually:
dig +noall +answer www.example.com CNAME
dig +noall +answer example.com MX
macOS: dig from Terminal
On macOS, open Terminal and use the same hosts.txt loop shown above if dig is installed and available in your environment. Inspect a specific hostname with:
dig +noall +answer api.example.com A
dig +noall +answer example.com NS
+answer includes the answer section with types and TTL; the simpler +short output is convenient for manually inspecting one record type. Query output depends on resolver selection, cache and time of collection. Keep collection parameters consistent when comparing later snapshots.
Windows: PowerShell CSV export
In Windows PowerShell, put hosts.txt in the working directory. Resolve-DnsName is part of the Windows DNS Client module. The following queries known hosts for A answers and exports compatible CSV:
$hosts = Get-Content .\hosts.txt | Where-Object {
$_.Trim() -ne '' -and -not $_.Trim().StartsWith('#')
}
$rows = foreach ($hostName in $hosts) {
Resolve-DnsName -Name $hostName.Trim() -Type A -DnsOnly `
-ErrorAction SilentlyContinue |
Where-Object { $_.Type -eq 'A' } |
ForEach-Object {
[pscustomobject]@{
hostname = $hostName.Trim()
type = 'A'
value = $_.IPAddress
}
}
}
$rows | Export-Csv .\inventory.csv -NoTypeInformation -Encoding UTF8
Inspect the CSV header and records. A missing line may reflect lookup failure or absence of an A answer, not deletion. To view other record types without converting them:
Resolve-DnsName -Name www.example.com -Type CNAME -DnsOnly
Resolve-DnsName -Name example.com -Type MX -DnsOnly
Compare observations responsibly
Collect the same host list, record types and resolver conditions at each time. Import each CSV into the correct Before or After panel and set your base-domain scope. Review the filenames, record counts and warnings. If a query fails, record the failure separately instead of describing it as a removed DNS record.
For a full zone configuration comparison, obtain two equivalent provider exports using the Cloudflare, GoDaddy, or Azure/Route 53 guides. Read the evidence limitations before making a security or operational decision.