AFAIK you can't - There is no reliable way to know how many CNAMEs point to a given hostname. DNS does not have a link/reference count like a filesystem does.
Restricting the problem to a single domain makes it more plausible, but still not really possible within the constraints you provided in your question:
- If you can do an
AXFR of the domain (
dig -t AXFR domain.com) you'll get a dump of all the records, and you can parse them.
- Alternatively you can examine the zone file if you have access to it.
If neither of those is an option, or if you're not restricting yourself to a single domain the problem is effectively unsolvable - it's like asking how many people in the world used the word "wombat" today.