22

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here.

More info: https://stackoverflow.com/faq

Anyone knows if it's possible to find all A records, CNAME or subzone records configured for a domain name?

For example, domain.com:

www IN CNAME domain.com.
subdomain1 IN CNAME domain.com.
subdomain2 IN CNAME domain.com. 

subdomain1 IN A 123.4.56.78.
subdomain2 IN A 123.4.56.79.

I want to keep a sub-domain private where I'll run an admin application (it will be password protected and on a special port, but I would prefer to keep it as private as possible).

Community
  • 1
  • 1
smartins
  • 3,808
  • 7
  • 42
  • 54
  • Related and possible duplicate: ["_How do I get a list of all subdomains of a domain? \[closed\]_"](https://stackoverflow.com/q/131989/11107541) – starball Dec 31 '22 at 03:07
  • I've tried most of the solution mentioned below and none worked. – Raymond Mar 27 '23 at 15:10

5 Answers5

5

Like others have said, what you want is a so called zone-transfer. If it is your own domain you can configure the DNS server to give it to you. If it is for some other domain you probably don't get it, since most DNS-admins consider it a security threat.

Even if an individual record isn't a problem (thats what the DNS it therefore) it could be a problem if an evil person gets a list of all your records: It could simplify an attack.

some
  • 48,070
  • 14
  • 77
  • 93
4

Using zone transfer, i.e.: (in nslookup)

ls -d google.com

If you have your own DNS server, there will be zone transfer security settings (usually by IP). Otherwise, just try it and see if it works.

Mark
  • 6,269
  • 2
  • 35
  • 34
  • I tried to use nslookup to get the records but it seems that my dns server is doing it's job correctly: *** Can't list domain domain.com: Query refused The DNS server refused to transfer the zone domain.com to your computer. .... – smartins Nov 20 '08 at 15:33
3

Preventing zone-transfers is a function of the server administration, and as others have said is typically disabled these days for security reasons.

When the time comes to add DNSSEC, make sure you use the new NSEC3 format records (from RFC 5155) rather than the original NSEC format as the latter allows for zone enumeration.

Note that preventing zone enumeration really is just security-via-obscurity. If someone finds your subdomain you'll still need additional security at the application layer.

As for your example records:

www IN CNAME domain.com.
subdomain1 IN CNAME domain.com.
subdomain2 IN CNAME domain.com. 
subdomain1 IN A 123.4.56.78.
subdomain2 IN A 123.4.56.79.
  1. You can't mix CNAME records and other RRtypes in the same entity
  2. The trailing dots in the A records are invalid
  3. It's best not to use a CNAME back to the domain for the WWW record

You need:

$ORIGIN domain.com
@      IN SOA ...
       IN A   123.4.56.78
www    IN A   123.4.56.78
sub1   IN A   123.4.56.79

(where sub1.domain.com is the hidden site)

Alnitak
  • 334,560
  • 70
  • 407
  • 495
  • The example I indicated was taken from an article just to illustrate what I wanted to ask. I actually use DNS Server from Windows 2003 Server. Also, thanks for the pointer on DNSSEC. – smartins Nov 27 '08 at 15:36
2

It used to be possible with:

host -a -l domain.com
csl
  • 10,937
  • 5
  • 57
  • 89
-1

If name servers allow zone transfers you can use this page http://www.magic-net.info/dns-lookup.dnslookup to find all subdomains in given zone.

15 oct. I`m have modified my tool. Now it checks first 6 name servers for zone transfers and, if no one allow zone transfers, uses search engeines Reverse lookup and subdomains search

acme
  • 14,654
  • 7
  • 75
  • 109