0

So I have a domain name let's say example.com, so is it possible to find all the sub-domains like a.example.com, b.example.com, etc.?

Patrick Mevzek
  • 10,995
  • 16
  • 38
  • 54
joedenly
  • 383
  • 2
  • 5
  • 14
  • 1
    Does this answer your question? [How do I get a list of all subdomains of a domain?](https://stackoverflow.com/questions/131989/how-do-i-get-a-list-of-all-subdomains-of-a-domain) – John Cogan Feb 20 '20 at 08:15
  • Does this answer your question? [How to find subdomain from a url](https://stackoverflow.com/questions/4883687/how-to-find-subdomain-from-a-url) – SparkFountain Feb 20 '20 at 10:04

1 Answers1

0

You can use command like:

dig example.com ALL

or 

host -l example.com

But be aware you will get result only if machine where you run this have permission to do zone transfers for this domain. Otherwise you will see nothing.

Patrick Mevzek
  • 10,995
  • 16
  • 38
  • 54
Romeo Ninov
  • 6,538
  • 1
  • 22
  • 31
  • No. Double No. First `ALL` is not `AXFR` so your example and your text disagree. `AXFR` is almost always filtered anyway and if you use it you should contact the authoritative nameserfvers not a random one. As for `ALL` which is `ANY` in fact, it is 1) deprecated 2) not doing what people think it does, as it gives the content of the cache of the resolver you query, which is certainly not all records. – Patrick Mevzek Feb 20 '20 at 15:06