Our company owns over 60 domains and a few external IP addresses (several domains share an external IP address). How do I discover all the domains that use a particular IP address (e.g. 69.x.x.7) without going through the DNS information on each domain? The particular webserver is running Windows 2003 and IIS6. Thanks, in advance, for your help!


If you know the web sites in question you can simply do an nslookup on them, which can be done via a batch file.

I suggest that when you get this information you use it to start the documentation that will allow to to easily look up the answer to such questions in the future.

  • +1 on documenting this disaster (& developing/implementing/buying a system to keep track of it in the future so your documentation stays up to date!) – voretaq7 May 21 '10 at 3:17

The place to look is your DNS data. Your DNS administrator(s) should be able to to tell you which A records exist for the the address. As noted above you also need to get them to find all the CNAME records which point to one of these CNAME records.

If you know all the domains your company owns, you may be able fetch the data using zone transfers.


Reverse IP can do what you want.

These people charge for a big/long list of domains, but who doesn't...

  • I just gave it a try and for the IP address I tested it indicated there are 82 domains, whereas in reality there are 154. Hardly worth paying for that result. – John Gardeniers May 20 '10 at 21:52
  • Ah, sorry dude. I'll be sure to stop recommending them. – zamabe May 24 '10 at 0:13

You can use the IIS administrative API to enumerate your server's settings, including bindings. Have a look at this post from David Wang. There's a nice example of a script that'll do it, including your IP bindings.

You should also be able to look in the IIS metabase for details on your server config. The location is %systemroot%\system32\inetsrv\MetaBase.xml.


Try This. It's free, but may not necessarily be 100% accurate.

  • Relies on reverse DNS, which may or may not exist. – John Gardeniers May 20 '10 at 21:43

Domaintool's Reverse IP may get you all the A records, but it's going to miss any CNAME records, subdomains, or forwarded domains. The lack of a centralized authority for this kind of information makes this particularly difficult. That was all hashed out in this question.

If you're also hosting DNS on Windows Server 2003, you can accomplish the same thing for free by searching for your IP addresses in all the files in %SystemRoot%\System32\DNS. Alternatively, if you can get even read access to the zone files from your DNS host, you might be able to do something similar.

You'll still have to come up with another way to handle CNAMEs though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.