Company.org has requested a black-box security assessment be performed on key cyber terrain. On area of concern is the company's SMTP services. The security assessor wants to run reconnaissance…

The dnsrecon tool with -t SOA queries the Start of Authority record, identifying the primary authoritative nameserver for the domain. In a black-box engagement this is the appropriate first reconnaissance step because it establishes the authoritative DNS source from which all subsequent zone enumeration - including MX and A records for SMTP services - can be performed reliably without relying on potentially cached resolver responses.

While 'dig company.org mx' directly returns MX records, it relies on recursive resolvers and does not establish the authoritative source needed for thorough black-box DNS reconnaissance.

nc -v company.org attempts a TCP connection to the host but performs no DNS enumeration and does not identify which SMTP server is Internet-facing.

whois company.org returns registrar and administrative contact information, not DNS mail exchange or SMTP server details.