shadow1ng/fscan · error

cannot find DC for %s

Error message

cannot find DC for %s

What it means

findDC's last-resort check pings the domain ("ping -n 1 <domain>") to confirm a domain controller is discoverable; when the ping fails and no DC was otherwise located, it returns "cannot find DC for <domain>". It signals that no domain controller could be identified or reached for the given domain name.

Source

Thrown at plugins/local/systeminfo_dc_windows.go:127

func (p *SystemInfoPlugin) findDC(domain string) (string, error) {
	if out, err := exec.Command("nslookup", "-type=SRV", fmt.Sprintf("_ldap._tcp.dc._msdcs.%s", domain)).Output(); err == nil {
		for _, line := range strings.Split(string(out), "\n") {
			if common.ContainsAny(line, "svr hostname", "service") {
				parts := strings.Split(line, "=")
				if len(parts) > 1 {
					host := strings.TrimSpace(parts[len(parts)-1])
					host = strings.TrimSuffix(host, ".")
					if host != "" {
						return host, nil
					}
				}
			}
		}
	}
	if err := exec.Command("ping", "-n", "1", domain).Run(); err == nil {
		return domain, nil
	}
	return "", fmt.Errorf("cannot find DC for %s", domain)
}

func (p *SystemInfoPlugin) getBaseDN(conn *ldap.Conn, domain string) (string, error) {
	sr, err := conn.Search(ldap.NewSearchRequest("", ldap.ScopeBaseObject, ldap.NeverDerefAliases, 0, 0, false, "(objectClass=*)", []string{"defaultNamingContext"}, nil))
	if err == nil && len(sr.Entries) > 0 {
		if dn := sr.Entries[0].GetAttributeValue("defaultNamingContext"); dn != "" {
			return dn, nil
		}
	}
	var parts []string
	for _, p := range strings.Split(domain, ".") {
		parts = append(parts, fmt.Sprintf("DC=%s", p))
	}
	return strings.Join(parts, ","), nil
}

func (p *SystemInfoPlugin) queryDomainBasicInfo(conn *domainInfo) {
	sr, err := conn.LDAPConn.Search(ldap.NewSearchRequest(conn.BaseDN, ldap.ScopeBaseObject, ldap.NeverDerefAliases, 0, 0, false, "(objectClass=*)", []string{"whenCreated", "whenChanged", "msDS-Behavior-Version"}, nil))

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify the domain name spelling and that DNS resolves it (nslookup <domain>) from the scanning host.
2. Ensure the scanning host is connected to the network/VPN where the domain's DCs are reachable.
3. Add the domain's DNS suffix/search configuration so bare domain lookups resolve.
4. Check whether ICMP is blocked; if DCs are reachable but ping is filtered, run the tool with a resolvable DC hostname instead of the bare domain.

Example fix

// before
return "", fmt.Errorf("cannot find DC for %s", domain) // ping -n 1 corp.example.com failed
// after (pre-verify on the caller side)
if out, err := exec.Command("nslookup", domain).CombinedOutput(); err != nil {
    return nil, fmt.Errorf("domain %s does not resolve: %v: %s", domain, err, out)
}
// then call connectToDomain with a resolvable domain or explicit DC host

// Confirm the domain resolves before attempting DC discovery
addrs, err := net.LookupHost(domain)
if err != nil || len(addrs) == 0 {
    return fmt.Errorf("domain %s does not resolve; check DNS/VPN", domain)
}

result := plugin.Scan(ctx, host, session)
if result != nil && !result.Success && strings.Contains(result.Error.Error(), "cannot find DC for") {
    // surface to user: wrong domain name, offline VPN, or DNS suffix problem
}

When it happens

Trigger: exec.Command("ping", "-n", "1", domain).Run() returns an error after prior DC-lookup steps failed — i.e., the domain name is unresolvable, ICMP is blocked, or no DC responds for that domain.

Common situations: Typo in the domain name, scanner host not on the corporate network/VPN, DNS search suffix missing so bare domain names don't resolve, ICMP blocked by firewall making the fallback ping fail even when LDAP would work, or the target is not actually an AD domain.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• LDAP dial: %w
• no IPv4 found
• GSSAPI bind: %w
• service_conn_port_failed: %w
• mcs sendConnectInitial write error %v

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/99f87f36b151df9d. Report an issue: GitHub.