48

I cannot list them using dig/nslookup/host.

Improve this question
1
  • 2
    You cannot crawl an entire domain without previously knowing all its RR. For a discussion about this feature, see the work related to NSEC3 design (listed in RFC5155, section 1.1)
    – Manu H
    Oct 8, 2014 at 6:50

3 Answers 3

Reset to default
34

There are two ways, both require administrator access or trust to the DNS records:

  • Perform a zone transfer (AXFR) on the domain to retrieve all records for the domain. The DNS administrator needs to explicitly allow AXFR transfers to your IP address from your chosen DNS server. You can perform such a transfer like this: dig @ns1.google.com google.com AXFR
  • Directly view the zonefile on the relevant DNS server. You need administrator access to the DNS server for this.
Improve this answer
13

With proper permissions on the DNS, grep for cname records:

host -t axfr my.dom.com dns.my.dom.com | grep -i cname
Improve this answer
1

I don't know if this addresses the need for "all" CNAME records for a given domain absent suitable authority as set out above, but as of May 2023 the following trick of querying dig with a proposed CNAME works, for example if you want to check for the CNAME www.stackexchange.com:

dalton@dalton-Precision-3541:$ dig +nocmd www.stackexchange.com +noall +answer
www.stackexchange.com.  219 IN  CNAME   stackexchange.com.
stackexchange.com.  219 IN  A   151.101.65.69
stackexchange.com.  219 IN  A   151.101.129.69
stackexchange.com.  219 IN  A   151.101.1.69
stackexchange.com.  219 IN  A   151.101.193.69
dalton@dalton-Precision-3541:$ date
Fri May  5 07:54:23 MDT 2023

That output gives you the A record, i.e., the canonical name for the site is stackexchange.com and its value is the IP address (four given). The alias or CNAME shown, which refers to the canonical name, is www.stackexchange.com. I note that the choice of terminology is a little confusing, i.e., the CNAME type is an alias to the canonical name in the A record.

In case there are operating system differences in dig and dig version differences, I used above:

 DiG 9.11.3-1ubuntu1.11-Ubuntu

If you query with the canonical name, you obtain only the A records:

dalton@dalton-Precision-3541:$ dig +nocmd stackexchange.com +noall +answer
stackexchange.com.  300 IN  A   151.101.129.69
stackexchange.com.  300 IN  A   151.101.193.69
stackexchange.com.  300 IN  A   151.101.65.69
stackexchange.com.  300 IN  A   151.101.1.69
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .