0

Suppose I define an A record in my DNS for host foo.example.com. If nobody knows about the existence of foo.example.com, but do about example.com, could someone somehow query the DNS records of example.com to return that name foo.example.com?

3
  • 5
    DNS records are public. That's kind of the whole point of them.
    – Jenny D
    May 22, 2013 at 6:56
  • @Jenny D, That's not what he's asking.
    – haim770
    May 22, 2013 at 7:09
  • @haim770 It's not, but it's still important to note for readers in passing. Internet facing DNS is not where one puts things that they don't want on public record. (i.e. private IPs)
    – Andrew B
    May 23, 2013 at 5:31

2 Answers 2

12

The answer is it depends. If the user can guess the name, like www, then yes they can. If you use more esoteric names the user would only be able to get arbitrary records if they were able to do what's called a zone transfer, which sends the entire domain's data.

Most nameservers disallow zone transfers by default. You can test yours here:

https://tools.digitalpoint.com/zone-transfer?domain=example.com

2
  • 3
    You can also test yourself by using dig -t AXFR domain.com you'll either get a "denied" message or it'll dump all the zone records.
    – Nathan C
    May 22, 2013 at 12:02
  • 1
    @Nathan With the caveat that the dig should be performed from outside the network, otherwise you risk a false positive.
    – Andrew B
    May 23, 2013 at 5:28
3

From end-user perspective of view, no. DNS will only return results for specific Hostname (or IP address for reverse-lookup).

Yet, many DNS servers support the feature known as Zone Transfer, that basically can dump all zone file data to another machine.

By doing so, the server can save some load by letting all other DNS servers have the full zone file instead of delegating the resolve request to it.

In reality, most DNS Administrators will not allow Zone Transfer for obvious (security) reasons.

If you want to try it yourself, use nslookup (in Windows):

//#requesting for google.com dns server
set q=ns
google.com

#response is: primary name server = ns1.google.com

server ns1.google.com    
ls -d google.com //#this is the zone transfer request

More in Wikipedia

1
  • If I could accept 2 answers I would. This answer is also very helpful, thank you!
    – Jim Soho
    May 22, 2013 at 7:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .