How do I get a list of all subdomains of a domain?

dns subdomain dig nameservers
cgicgi picture cgicgi · Sep 25, 2008 · Viewed 484.6k times · Source

I want to find out all the subdomains of a given domain. I found a hint which tells me to dig the authoritative Nameserver with the following option:

dig @ns1.foo.bar some_domain.com axfr

But this never works. Has anyone a better idea/approach

Answer

TimB picture TimB · Sep 25, 2008

The hint (using axfr) only works if the NS you're querying (ns1.foo.bar in your example) is configured to allow AXFR requests from the IP you're using; this is unlikely, unless your IP is configured as a secondary for the domain in question.

Basically, there's no easy way to do it if you're not allowed to use axfr. This is intentional, so the only way around it would be via brute force (i.e. dig a.some_domain.com, dig b.some_domain.com, ...), which I can't recommend, as it could be viewed as a denial of service attack.

Related questions

search for ALL DNS TXT records of a domain and subdomains

There is a way to retrieve ALL (TXT) entries about DNS records of a domain (and subdomains) ? My goal is to verify the configuration of my domain: www.rosposhop.com where I correctly set multiple SPF and DKIM records for …

Read More
.htaccess rewrite subdomain to directory

Is it possible to use .htaccess to rewrite a sub domain to a directory? Example: http://sub.domain.com/ shows the content of http://domain.com/subdomains/sub/

Read More
Can (domain name) subdomains have an underscore "_" in it?

Can subdomains (domain names) have underscore _ in them?

Read More