165

My company runs an internal DNS for mycompany.example

There is a machine on the network that I need to find, but I’ve forgotten its name. If I could see a list, it would probably jog my memory.

How can I list all of the domain records for mycompany.example?

155

The short answer is to your specific question of listing CNAMEs is that you can't without permission to do zone transfers (see How to list all CNAME records for a given domain?).

That said, you can use dig to list the other records by doing:

dig +nocmd yourdomain.example any +multiline +noall +answer
  • 3
    any is no good on some DNS servers IN HINFO "ANY obsoleted" "See draft-ietf-dnsop-refuse-any" – niieani Nov 1 '17 at 19:51
  • 2
    The question has nothing to do with CNAME records... – Patrick Mevzek Oct 7 '18 at 17:44
  • for me, dig @8.8.8.8 +nocmd yourdomain.example any +multiline +noall +answer lists more records – Binar Web Feb 16 at 8:44
  • This command returns 0 answer records on any of 8 domains I tried. – Jim L. Apr 26 at 20:47
  • dig domain.com ANY is a much more clear and expressive answer. – Tomas Zubiri May 26 at 4:02
72

A much easier command to remember (and more informative) is:

> dig google.com ANY

Which returns the following:

; <<>> DiG 9.8.3-P1 <<>> google.com ANY
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31013
;; flags: qr rd ra; QUERY: 1, ANSWER: 22, AUTHORITY: 0, ADDITIONAL: 3

;; QUESTION SECTION:
;google.com.            IN  ANY

;; ANSWER SECTION:
google.com.     17  IN  A   74.125.225.72
google.com.     17  IN  A   74.125.225.73
google.com.     17  IN  A   74.125.225.78
google.com.     17  IN  A   74.125.225.64
google.com.     17  IN  A   74.125.225.65
google.com.     17  IN  A   74.125.225.66
google.com.     17  IN  A   74.125.225.67
google.com.     17  IN  A   74.125.225.68
google.com.     17  IN  A   74.125.225.69
google.com.     17  IN  A   74.125.225.70
google.com.     17  IN  A   74.125.225.71
google.com.     86400   IN  NS  ns1.google.com.
google.com.     86400   IN  NS  ns2.google.com.
google.com.     86400   IN  NS  ns3.google.com.
google.com.     86400   IN  NS  ns4.google.com.
google.com.     66641   IN  SOA ns1.google.com. dns-admin.google.com.    2013082900 7200 1800 1209600 300
google.com.     177 IN  MX  40 alt3.aspmx.l.google.com.
google.com.     177 IN  MX  50 alt4.aspmx.l.google.com.
google.com.     177 IN  MX  10 aspmx.l.google.com.
google.com.     177 IN  MX  20 alt1.aspmx.l.google.com.
google.com.     177 IN  MX  30 alt2.aspmx.l.google.com.
google.com.     287 IN  AAAA    2607:f8b0:4009:803::1007

;; ADDITIONAL SECTION:
ns1.google.com.     3924    IN  A   216.239.32.10
ns2.google.com.     64508   IN  A   216.239.34.10
ns3.google.com.     64508   IN  A   216.239.36.10

;; Query time: 77 msec
;; SERVER: 10.6.23.4#53(10.6.23.4)
;; WHEN: Fri Sep 13 14:26:09 2013
;; MSG SIZE  rcvd: 506
  • 18
    This is not what the question is asking for. It's asking for all of the records within the 'google.com.' domain, not just the records for 'google.com.'. There is nothing in your query listing anything not 'google.com.' except for the glue records (A records for the name servers). – yoonix Sep 13 '13 at 20:01
  • 5
    Perfect command. Succinct and easy to remember, thanks for posting! – fusion27 Jun 21 '14 at 14:24
  • Now the only answer from google.com to ANY queries is: google.com. 14400 IN CNAME forcesafesearch.google.com. (gist.github.com/Dorian/afb136672c91fc89df572a4b0f8106dd) – Dorian Sep 13 '16 at 14:17
  • 8
    The IETF proposes to refuse ANY. I get: HINFO "Please stop asking for ANY" "See draft-ietf-dnsop-refuse-any" – Tom Hale Nov 6 '16 at 8:40
53

Try:

dig -tAXFR mycompany.example

This may or may not work. Many DNS servers will deny a DNS Zone Transfer like this. For more information, see How the AXFR protocol works

  • 1
    You're on the right track, but that syntax doesn't work for me. What works is dig @ns.example.com -tAXFR example.com where ns.example.com is a primary nameserver for the zone, and where the DNS admin has enabled zone transfer requests from the host or IP you're querying from. Without AXFR permission there is no way to query ALL DNS records in a zone. I'm not sure, but I don't believe AXFR requests can be done recursively, hence the need to query the zone's top-level nameserver directly, which is what the @ns.example.com part of the syntax does. The actual hostname will vary. – Jim L. Apr 26 at 21:01
  • Yes @Jim you’re right, you may need to specify an authoritative nameserver to query. – Josh Apr 27 at 15:02
22

You can also use host DNS lookup utility with -l switch:

host -l example.com

Of course you need DNS zone transfer rights for this to work.

  • 1
    same as dig -t AXFR domain.name – XXL Jan 15 '12 at 23:33
  • 10
    @XXL ... except a lot easier to remember.... +1 – Jeremy Holovacs Dec 9 '12 at 20:20
3

The approach you're trying to use won't work. See this question for more information. Assuming you're the admin (if you're not please discuss this with your admin and read the FAQ before posting again) simply look up the zone file.

2
dnscmd <ServerName> /zoneprint <Domain>

I found none of the answers so far would work for me, mostly due to zone transfer failures. This command did not run into that issue and presented me with something closer to what I get in the DNS Manager tool.

  • For me this is the best answer. No zone transfer issues, just pipe it to find and you're done. All domain records referencing the server you're interested in. (note ServerName above is the DNS server). – aucuparia Jul 26 '17 at 15:18
  • 1
    weird, could not brew install dnscmd – the0ther Nov 7 '17 at 14:42
  • 1
    dnscmd is windows only: see technet.microsoft.com/en-us/library/cc784399(v=ws.10).aspx – user906489 Feb 10 '18 at 9:54
0

You can also use nslookup tool:

nslookup example.com
-6

I ended up using nmap to scan the network.

For example:

nmap -v -sP 192.16.0.0/16
  • 6
    That's a good solution to your problem but not a great answer to the question "List all DNS records in a domain using dig?". You might want to edit your question and change the title. – Josh May 5 '10 at 19:20
  • 18
    nmaping a /16 will generate 256^2 (65536) DNS lookups. I bet your DNS admins love you. – markdrayton May 5 '10 at 19:27
  • 4
    @markdrayton, although the scan will send out 2^16 ping requests (~50Mb of raw data, filtered out by most network interfaces), it will only perform reverse-DNS lookups for the hosts that are online. – Zaz Jun 23 '14 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.