Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to query for this without having access to the zone file?

E.g, I'd want all the A, CNAME, MX and TXT records that pertain to

share|improve this question
This is another one of those all too frequently asked questions for which we need a single one to use as the ultimate version. – John Gardeniers May 24 '11 at 13:12
My apologies. I tried searching but I could not find the answer anywhere on serverfault. My search-fu might not be up to par. – Belmin Fernandez May 24 '11 at 14:44
not your fault. I also tried a search and failed to find what I was looking for, despite the fact that this question keeps popping up. This site's search leaves a LOT to be desired. – John Gardeniers May 24 '11 at 21:41
up vote 10 down vote accepted

By design, the only way to get this is through a zone-transfer, and best-practice has stated for quite some time now that those should only be permitted for certain specified IP addresses that need to have that kind of access.

However, if the domain's DNS servers permit it, you can grab the output from command-line utilities. Specifically, in nslookup you can enter ls to initiate one, and there are options for LS depending on what exact nslookup you're using. Dig can also be used, dig axfr.

As I mentioned, this requires the name-servers in question to permit zone-transfers. This is a configuration that is against best-practice, so its utility is likely pretty small these days.

share|improve this answer

As sysadmin said, only if you are allowed zone transfers, which as a practical matter means only if it is your own DNS server. You would be very hard pressed to find any DNS servers on the Internet that would allow it as a rule.

If the reason is that you need all of your DNS records, and you do not host your own DNS, you can just call your ISP and ask for a complete list.

If it is not your domain, and you are just poking around, you are pretty much out of luck.

share|improve this answer

Others have stated that authorized database replication (whether that employs the "zone transfer" mechanism or some other replication mechanism) is the only way to obtain this information and that therefore the answer is "No." (presuming that "without having access to the zone file" means "I won't take the straightforward route of simply asking the person who has the database to send a copy of it to me.").

In fact, the answer is "Yes." (provided that one only wants to obtain the subset of information that is encompassed by the DNS database schema, and not things like database record tags, server-side aliases, and macros). One can walk the NXT/NSEC/NSEC3 records to obtain a list of subdomain names, and then send ordinary queries for the actual resource record sets for those names.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.