Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My company runs an internal DNS for

There is a machine on the network that I need to find, but I’ve forgotten its name. If I could see a list, it would probably jog my memory.

How can I list all of the domain records for

share|improve this question

The short answer is to your specific question of listing CNAMEs is that you can't without permission to do zone transfers (see How to list all CNAME records for a given domain?).

That said, you can use dig to list the other records by doing:

dig +nocmd any +multiline +noall +answer
share|improve this answer


dig -tAXFR

This may or may not work. Many DNS servers will deny a DNS Zone Transfer like this. For more information, see How the AXFR protocol works

share|improve this answer

A much easier command to remember (and more informative) is:

> dig ANY

Which returns the following:

; <<>> DiG 9.8.3-P1 <<>> ANY
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31013
;; flags: qr rd ra; QUERY: 1, ANSWER: 22, AUTHORITY: 0, ADDITIONAL: 3

;            IN  ANY

;; ANSWER SECTION:     17  IN  A     17  IN  A     17  IN  A     17  IN  A     17  IN  A     17  IN  A     17  IN  A     17  IN  A     17  IN  A     17  IN  A     17  IN  A     86400   IN  NS     86400   IN  NS     86400   IN  NS     86400   IN  NS     66641   IN  SOA    2013082900 7200 1800 1209600 300     177 IN  MX  40     177 IN  MX  50     177 IN  MX  10     177 IN  MX  20     177 IN  MX  30     287 IN  AAAA    2607:f8b0:4009:803::1007

;; ADDITIONAL SECTION:     3924    IN  A     64508   IN  A     64508   IN  A

;; Query time: 77 msec
;; WHEN: Fri Sep 13 14:26:09 2013
;; MSG SIZE  rcvd: 506
share|improve this answer
This is not what the question is asking for. It's asking for all of the records within the '' domain, not just the records for ''. There is nothing in your query listing anything not '' except for the glue records (A records for the name servers). – yoonix Sep 13 '13 at 20:01
Perfect command. Succinct and easy to remember, thanks for posting! – fusion27 Jun 21 '14 at 14:24

You can also use host DNS lookup utility with -l switch:

host -l

Of course you need DNS zone transfer rights for this to work.

share|improve this answer
same as dig -t AXFR – XXL Jan 15 '12 at 23:33
@XXL ... except a lot easier to remember.... +1 – Jeremy Holovacs Dec 9 '12 at 20:20

The approach you're trying to use won't work. See this question for more information. Assuming you're the admin (if you're not please discuss this with your admin and read the FAQ before posting again) simply look up the zone file.

share|improve this answer

I ended up using nmap to scan the network.

For example:

nmap -v -sP
share|improve this answer
That's a good solution to your problem but not a great answer to the question "List all DNS records in a domain using dig?". You might want to edit your question and change the title. – Josh May 5 '10 at 19:20
nmaping a /16 will generate 256^2 (65536) DNS lookups. I bet your DNS admins love you. – markdrayton May 5 '10 at 19:27
@markdrayton, although the scan will send out 2^16 ping requests (~50Mb of raw data, filtered out by most network interfaces), it will only perform reverse-DNS lookups for the hosts that are online. – Zaz Jun 23 '14 at 19:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.