Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way of finding out a total list of A and CNAME records for a domain if Zone Transfer is disabled?

Client is Windows, and I've already tried ls -d in nslookup (hence how I know Zone Transfer is disabled).

share|improve this question
up vote 4 down vote accepted

No, there is no method for doing this. This is specifically why Zone transfer is to be disabled to untrusted DNS peers - To prevent discovery of the entire DNS topology.

share|improve this answer

Chris Thorpe and einstieen are right in 99.99 % of the cases. There is no way.

In very rare cases, there is another method: NSEC walking. If the zone is signed with DNSSEC (something that will be more and more common now that the root is signed), and if it is signed with NSEC, not NSEC3, and if there is no rate-limiting in place, you may walk the entire zone. See an explanation and implementation. (There is an alternative implementation using ldns).

share|improve this answer

I'm 99% certain there isn't a way. I've actually made an argument on here against AXFR for this very reason. The only thing I can think of is brute forcing it, but that may seem a little cumbersome and unnecessary depending on why you need to.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.