How can I get from a specific name server, say
ns.example.com, all A records pointing to a specific IP
I've been trying with reverse DNS lookup tools, but I cant manage to get what I need.
Remotely: that would require a zone transfer, which will be blocked unless security on the server was configured very poorly.
Locally: You can open the zone file and grep through it.
This is impossible.
If you had admin access to the server in question you could grep the configuration files, but within the DNS protocol you just can't do it.
Even AXFR isn't sufficient, since even if it's enabled, you'd have to know every single domain name being served from that server.
The simple answer is No. I have seen a site that claimed to do this, but it didn't serve all the A records for cases where I knew some of the answer.
The PTR records used for reverse DNS records belong to different zones than the related A records. They may note be administered in the same DNS servers or by the same organizaations. It is possible that several DNS administrations have A records pointing to the same IP address. The DNS admimistrator for the PTR records may well be unaware of at least some of them.
There are a number of services offering Dynamic DNS. It would be extremely rare for the PTR to match A record. In many case there is no PTR record for the IP address.
For properly configured mail servers there will be a PTR record matching the A record for the mail service. This may not be the only A record for the server. It has been my experience that most spam comes from IP addresses where the PTR record does not match the A record, and in many case at least one record is missing.
If an address is also used for virtual Web servers, there will be more than one A record. These may be spread across a number of domains, and the various DNS aministrators may be unware that others are using the same IP address.