DNS ANY Record Query - Recon Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects DNS ANY record queries, which can be used for reconnaissance purposes. An ANY record query (QTYPE=255 or 0xFF) requests all available record types for a given domain. While legitimate uses exist, it is often abused by attackers to gather extensive information about a target's DNS infrastructure, making it a common indicator of reconnaissance activity.