Don't 'A' records only return IPv4 addresses?

Why do some websites return subdomains? How do they find those subdomains? I mean, are they doing normal subdomain bruteforcing then resolve each subdomain's A record?

Examples of those websites: DNSDumpster.com => Under 'A' Host Records section

and this one as well https://hackertarget.com/find-dns-host-records/

For example, when looking for uber.com, it returns the following list of subdomains: Example

Does that mean that it tries to match whatever entries having the string uber.com ocurence and returns its corresponding IPv4 address in the DNS server?


The answer is in the pages for the links you posted.

Short answer: brute force & big data. Long answer: “The data we use to find host records here at hackertarget.com is sourced from a number of excellent projects as well as Internet search engines.”

Not the answer you're looking for? Browse other questions tagged or ask your own question.