Is there some kind of "subdomain listing" query for DNS?
There is no query for this specific purpose, but there are a few indirect methods.
- A non-incremental zone transfer (
AXFR). Most server operators lock down zone transfers to specific IP addresses to prevent unaffiliated parties from snooping around.
- If DNSSEC is enabled, iterative
NSEC requests can be used to walk the zone.
NSEC3 was implemented to make zone walking more computationally intensive.
There's also a trick that will let someone know if an arbitrary subdomain exists.
example.com. IN A 198.51.100.1
www.sub.example.com. IN A 198.51.100.2
In the above example,
www lies within
sub. A query for
sub.example.com IN A will not return an ANSWER section, but the result code will be NOERROR instead of NXDOMAIN, betraying the existence of records further down the tree. (just not what those records are named)
Should secrecy of DNS records ever be relied upon?
No. The only way to reliably hide data from a client is to ensure that it can never get the data to begin with. Assume that existence of your DNS records will be spread among whoever has access to them, either by word of mouth or by observing the packets.
If you're trying to hide records from a routable DNS client, You're Doing It Wrong™. Make sure the data is only exposed to the environments that need it. (i.e. use privately routed domains for private IPs) Even if you have such a division set up, assume that knowledge of the IP addresses will be spread around anyway.
The focus on security should be on what happens when someone gets the IP address, because it's going to happen.
I'm aware that the list of reasons for IP address secrecy being a pipe dream could be expanded on further. IP scanning, social engineering...the list is endless, and I'm mostly focusing on the DNS protocol aspects of this question. At the end of the day, it all falls under the same umbrella: someone is going to get your IP address.