Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there any way of finding out a total list of A and CNAME records for a domain if Zone Transfer is disabled?

Client is Windows, and I've already tried ls -d example.com in nslookup (hence how I know Zone Transfer is disabled).

share|improve this question

3 Answers 3

up vote 5 down vote accepted

No, there is no method for doing this. This is specifically why Zone transfer is to be disabled to untrusted DNS peers - To prevent discovery of the entire DNS topology.

share|improve this answer

Chris Thorpe and einstieen are right in 99.99 % of the cases. There is no way.

In very rare cases, there is another method: NSEC walking. If the zone is signed with DNSSEC (something that will be more and more common now that the root is signed), and if it is signed with NSEC, not NSEC3, and if there is no rate-limiting in place, you may walk the entire zone. See an explanation and implementation. (There is an alternative implementation using ldns).

share|improve this answer

I'm 99% certain there isn't a way. I've actually made an argument on here against AXFR for this very reason. The only thing I can think of is brute forcing it, but that may seem a little cumbersome and unnecessary depending on why you need to.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.