List all DNS records in a domain using dig?

Question

My company runs an internal DNS for "mycompany.com"

There is a machine on the network that I need to find, but I've forgotten it's name. If I could see a list, it would probably jog my memory.

How can I list all of the domain records for "mycompany.com"?

Answer 1

Try:

dig -tAXFR mycompany.com

This may or may not work. Many DNS servers will deny a DNS Zone Transfer like this. For more information, see How the AXFR protocol works

Answer 2

The approach you're trying to use won't work. See this question for more information. Assuming you're the admin (if you're not please discuss this with your admin and read the FAQ before posting again) simply look up the zone file.

Answer 3

The short answer is to your specific question of listing CNAMEs is that you can't without permission to do zone transfers (see How to list all CNAME records for a given domain?).

That said, you can use dig to list the other records by doing:

dig +nocmd yourdomain.com any +multiline +noall +answer

Answer 4

You can also use host DNS lookup utility with -l switch:

host -l domain.com

Of course you need DNS zone transfer rights for this to work.

Answer 5

I ended up using nmap to scan the network.

For example:

nmap -v -sP 192.16.0.0/16