Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to query our internal DNS entries to discover all the CNAME entries that point to a particular server?

Edit: We're a Windows environment, Server 2003.

share|improve this question

You didn't specify what your environment is but if you're using Unix I think a combination of dig and grep should work. should be the hostname of your nameserver, is the domain your host is part of, and HOST is the host that you want to find all the CNAME records for. That's actually a tab character in the grep command, not literally <TAB> (you may have to adjust the grep string).

Also your nameserver needs to to be configured to allow zone transfers, the particulars of which will be implementation dependent.

dig axfr |grep 'CNAME<tab>HOST$'

Or if you're on Windows you could use nslookup:

C:\> nslookup
> name
> ls -a FILE

This should output all of the records for the domain that "knows about" to FILE. You can then use whatever tool you want to sort through the text file looking for the corresponding CNAMES.

Or with this untested (but seemly correct looking) perl script:


use Net::DNS;

($target, $zone) = @ARGV;

$res = new Net::DNS::Resolver;
foreach $rr ($res->axfr($zone)) {
     print $rr->name."\n" if (($rr->type eq "CNAME") && ($rr->rdatastr eq $target."."));

A couple of points for completeness:

  • As @womble stated, there's no equivalent of a PTR record for a CNAME. You'll have to use some contextual awareness by sorting through all the zone information for CNAMES that correspond to the A records of your host.
  • This only works for your DNS server (and if you have permission to view zone information). There's no way to "trace" CNAMES for your host that belong on other zones.
  • As @BillThor states, there are other ways to aliases a hostname beyond CNAMES. Again, you'll need some contextual awareness.
share|improve this answer
Question updated, we're on Windows. – PhilPursglove Jul 4 '11 at 8:39

If you have access to your DNS configuration, it is rather trivial to discover this data. However, anyone can have a CNAME pointing to your server. You won't be able to trace these.

As @wombie has pointed out you can't do a reverse lookup for CNAMES. There is no PTR equivalent for CNAMES, and even if there where it is likely only some records would exist. A quick check of a random selection of domains would show PTR records often don't point back to the A record. Likewise, doing reverse lookups of PTR records for random addresses often doesn't find the corresponding A record.

EDIT: CNAMEs are not the only way to alias a system. DNS allows multiple A records to point the the same address. Functionally this is the same as adding a CNAME but the method is different. Same problems apply outside your domain. To search for the various A records you would search for the IP address(es) of the system in question.

share|improve this answer

The DNS protocol does not allow you to do that sort of "reverse" lookup. You'll need to go out of protocol, such as using the grep suggestions provided by kce.

share|improve this answer
  1. Find all of the zones served by your machines.
  2. For each zone, use dnscmd to export the zone data:
    dnscmd /zoneexport some-filename-for-this-zone
  3. Search the exported files for CNAME resource records that point to the target domain name.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.