-1

For example, I want to find all domain names that are forwarded to bankofamerica.com.

I know that fleetbank.com and fleetboston.com both forward to bankofamerica.com.

How can I find ALL domain names that forward to bankofamerica.com?

(note that I'm interested in the general case, just using bankofamerica.com as the example)

Improve this question
5
  • I don't think the DNS works like that.
    – MadHatter
    Mar 6, 2014 at 14:54
  • Agreed, I'm guessing that there has to be some sort of programmatic step in between that trawls DNS records to obtain this data. I'd also guess somebody has already done this, so just trying to gain from their experience.
    – user211836
    Mar 6, 2014 at 15:00
  • 2
    It doesn't. If you knew the name of a particular nameserver it's possible to query for all of the entries in it. However, since anybody could configure a DNS server to forward to bankofamerica.com, there's no way to "backtrack" through DNS and reliably discover every domain that is forwarded to it.
    – tdk2fe
    Mar 6, 2014 at 15:01
  • I've edited the title to be more clear.
    – Andrew B
    Mar 6, 2014 at 15:08
  • DNS servers are generally configured to refuse requests from untrusted addresses to list all their domains.
    – Flup
    Mar 6, 2014 at 15:12

1 Answer 1

Reset to default
1

www.fleetbank.com and www.fleetboston.com are CNAME records that point to www.bankofamerica.com, among other DNS entries.

This is not possible to track down through normal means. CNAME records are not known about by the destination nameservers, unless the records are hosted by the same nameserver. (in which case the nameserver will also respond with the corresponding A record to speed up resolving)

;; QUESTION SECTION:
;www.fleetbank.com.             IN      A

;; ANSWER SECTION:
www.fleetbank.com.      3600    IN      CNAME   www.bankofamerica.com.
www.bankofamerica.com.  250     IN      CNAME   wwwui.ecglb.bac.com.
wwwui.ecglb.bac.com.    26      IN      A       171.161.199.100

In this scenario, www.bankofamerica.com resides on a different nameserver, and wwwwui.ecglb.bac.com resides on the same nameserver. It provides an A record hint for wwwui.ecglb.bac.com, but not www.bankofamerica.com. The nameservers for Bank of America have no knowledge that this CNAME exists.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .