I cannot list them using dig/nslookup/host.
There are two ways, both require administrator access or trust to the DNS records:
- Perform a zone transfer (AXFR) on the domain to retrieve all records for the domain. The DNS administrator needs to explicitly allow AXFR transfers to your IP address from your chosen DNS server. You can perform such a transfer like this:
dig @ns1.google.com google.com AXFR
- Directly view the zonefile on the relevant DNS server. You need administrator access to the DNS server for this.
I don't know if this addresses the need for "all" CNAME records for a given domain absent suitable authority as set out above, but as of May 2023 the following trick of querying
dig with a proposed CNAME works, for example if you want to check for the CNAME
dalton@dalton-Precision-3541:$ dig +nocmd www.stackexchange.com +noall +answer www.stackexchange.com. 219 IN CNAME stackexchange.com. stackexchange.com. 219 IN A 22.214.171.124 stackexchange.com. 219 IN A 126.96.36.199 stackexchange.com. 219 IN A 188.8.131.52 stackexchange.com. 219 IN A 184.108.40.206 dalton@dalton-Precision-3541:$ date Fri May 5 07:54:23 MDT 2023
That output gives you the A record, i.e., the canonical name for the site is
stackexchange.com and its value is the IP address (four given). The alias or CNAME shown, which refers to the canonical name, is
www.stackexchange.com. I note that the choice of terminology is a little confusing, i.e., the CNAME type is an alias to the canonical name in the A record.
In case there are operating system differences in
dig version differences, I used above:
If you query with the canonical name, you obtain only the A records:
dalton@dalton-Precision-3541:$ dig +nocmd stackexchange.com +noall +answer stackexchange.com. 300 IN A 220.127.116.11 stackexchange.com. 300 IN A 18.104.22.168 stackexchange.com. 300 IN A 22.214.171.124 stackexchange.com. 300 IN A 126.96.36.199