Finding every DNS record under a domain

Question

Is there a way to query for this without having access to the zone file?

E.g, I'd want all the A, CNAME, MX and TXT records that pertain to example.com.

Answer 1

By design, the only way to get this is through a zone-transfer, and best-practice has stated for quite some time now that those should only be permitted for certain specified IP addresses that need to have that kind of access.

However, if the domain's DNS servers permit it, you can grab the output from command-line utilities. Specifically, in nslookup you can enter ls to initiate one, and there are options for LS depending on what exact nslookup you're using. Dig can also be used, dig @ns1.example.com example.com axfr.

As I mentioned, this requires the name-servers in question to permit zone-transfers. This is a configuration that is against best-practice, so its utility is likely pretty small these days.

Answer 2

As sysadmin said, only if you are allowed zone transfers, which as a practical matter means only if it is your own DNS server. You would be very hard pressed to find any DNS servers on the Internet that would allow it as a rule.

If the reason is that you need all of your DNS records, and you do not host your own DNS, you can just call your ISP and ask for a complete list.

If it is not your domain, and you are just poking around, you are pretty much out of luck.

Answer 3

Others have stated that authorized database replication (whether that employs the "zone transfer" mechanism or some other replication mechanism) is the only way to obtain this information and that therefore the answer is "No." (presuming that "without having access to the zone file" means "I won't take the straightforward route of simply asking the person who has the database to send a copy of it to me.").

In fact, the answer is "Yes." (provided that one only wants to obtain the subset of information that is encompassed by the DNS database schema, and not things like database record tags, server-side aliases, and macros). One can walk the NXT/NSEC/NSEC3 records to obtain a list of subdomain names, and then send ordinary queries for the actual resource record sets for those names.