Information Technology Grimoire

Version .0.0.1

IT Notes from various projects because I forget, and hopefully they help you too.

DNS Lookups with Perl Net::DNS::Resolver

Sometimes when parsing logs or files you need to know what the IP resolves to. This Perl script uses Net::DNS::Resolver to Automate DNS Lookups.

The advantage of using Net::DNS::Resolver over other methods is the ability to get more information from the DNS servers, and specify which DNS servers to use.


# takes list of DATA and does dns lookup
# gethostbyaddr uses whatever is confiogured on said client
# Net DNS Resolver allows you to specify lookup servers in script

#usage: perl > hosts.csv

use warnings;
use strict;
use Socket;
use Net::DNS::Resolver;

my %ips;	# will hold deduped list of ips addresses

# process the data handle and load up the hash
while (<data>) {
	my $ip = $_;
	chomp $ip;

# get counts
my $ips = %ips;
my $count = 0;
print "FOUND $ips IPs\n";

# deduped, now proceed by looping over hash keys
foreach my $ip (keys %ips) {

	$count++;  # real count of found ips, different than input ips

	# if you want to see status on a large list (sometimes it takes hours to process large lists)
	#warn "$count -> $ip\n";

	# very crude, use real regex module if you care
	# if your input isn't tested, you need to fix this
	if($ip =~ /^\d+.\d+.\d+.\d+$/) {

	    # NET::DNS::Resolver way:
		# create new Resolver Object, YMMV
		my $res = new Net::DNS::Resolver(
			nameservers => [ '', '', '' ],
		#debug       => 1 # spews entire DNS query results
    		recurse     => 1,
    		# 1 = recursive, accurate, keeps asking anyone, even poisoned caches until it thinks answer is right
    		# 0 = iterative, final answer, no verification from others
    		#iterative is probably how security should be handled.

		# even with timeout of 5 this can take hours on a large list

		# change IP from to for searching
		my $target_IP = join('.', reverse split(/\./, $ip))."";

		# query DNS
		my $query = $res->query("$target_IP", "PTR");

		# if a result is found
		if ($query){

		    # for every result, print the IP address
		    foreach my $rr ($query->answer){
		        # show all unless the type is PTR (pointer to a canonical name)
		        next unless $rr->type eq "PTR";

		        # remove the period at the end
		        printf(substr($rr->rdatastr, 0, -1));
		        print "'\n";
		} else {
			print "'$ip','UNKNOWN'\n";

    } else {
        print " Expected: <host>, got <$ip>\n";


Last updated on 10 Oct 2018
Published on 10 Oct 2018