6

Is there any way of finding out a total list of A and CNAME records for a domain if Zone Transfer is disabled?

Client is Windows, and I've already tried ls -d example.com in nslookup (hence how I know Zone Transfer is disabled).

3 Answers 3

4

No, there is no method for doing this. This is specifically why Zone transfer is to be disabled to untrusted DNS peers - To prevent discovery of the entire DNS topology.

4

Chris Thorpe and einstieen are right in 99.99 % of the cases. There is no way.

In very rare cases, there is another method: NSEC walking. If the zone is signed with DNSSEC (something that will be more and more common now that the root is signed), and if it is signed with NSEC, not NSEC3, and if there is no rate-limiting in place, you may walk the entire zone. See an explanation and implementation. (There is an alternative implementation using ldns).

2

I'm 99% certain there isn't a way. I've actually made an argument on here against AXFR for this very reason. The only thing I can think of is brute forcing it, but that may seem a little cumbersome and unnecessary depending on why you need to.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .