Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I get all IPs of a domain name, say,

Of course, nslookup and host command will give me IPs of a domain. But what shall I do if I want a list ALL (or, at least a lot more than just one or two..) IPs of that domain?

share|improve this question

Try doing dig a. For me, it shows a consistent list of 6 IPv4 addresses.

share|improve this answer
True,.. it lists 6 IPv4 addresses. But for domains like, I'm expecting hundreds of results.. Thanks any way. – DenMark Jun 15 '10 at 9:38
Your expectations are wrong. Yes, Google has hundreds of servers, but they are backends. Each of these IP addresses really maps to hurd of servers, but they are hidden in Google's DC. Moreover, the single IP address may map to different servers over all the world like their DNS service does: – whitequark Jun 15 '10 at 10:11
Oh, That. You're correct.. There might be much less than hundreds of IPs. Yet, I'm pretty sure there're more than just 6 IPs bound to that domain. For I know other IPs that serves the same content (sure, owned by Google). Of course, one can argue that IP is serving the same content yet not bound to a domain. But It does not make much sense to do so (AFAIS). – DenMark Jun 15 '10 at 14:09
This may be correct too: I read somewhere that Google serves different IP's from theirs DNS servers based on client GeoIP data. You can still lookup Google AS in the WHOIS database to get the list of all assigned IP's, but I do not know a clear way to get a list of all IP's that can be served to clients all over the world. Also this will be probably useless because of anycast routing. – whitequark Jun 15 '10 at 15:31
Actually, I'm looking for a way around IP blocking of a domain. So, anycast routing seems not be a problem. Thanks again :) Oh, and yes exactly, I'm looking for a list of all IPs that can be served to clients all over the world. Just wonder if there is a way to achieve this. – DenMark Jun 17 '10 at 1:42

You might use the actual whois command, which should work on any IP address. The whois command will also return information such as the numbers of network bits (17). From this, you can determine the actual number of IP addresses. For example, if I whois the IP address, I will get:

NetRange: -
NetName:    GOOGLE
NetHandle:  NET-209-85-128-0-1
Parent:     NET-209-0-0-0-0
NetType:    Direct Allocation

The /17 means that a sub-class-B network, and that the number of possible addresses is :

2^(32-17) - 2


2^15 - 2


32,768 - 2


32766 possible IP addresses. The -2 is because of the very first address (the network address , and the very last one, which is the broadcast address (, both addresses cannot be used to point to a host.

This is for IPv4 addresses, of course.

The whois will return different information when you use a domain name such as Finally, keep in mind that the returned IP for a host name can depend on the country where you actually are.

host will return a single IP address when queried from Ottawa, Canada.

$ host has address mail is handled by 100 mail is handled by 200 mail is handled by 300 mail is handled by 400
share|improve this answer
but you cant tell if all of the ip addresses in that range are used by this domain withhout more complicated checks and even then there can be more ranges associated to that domain – matthias krull Jul 7 '10 at 21:26
True, but this is a good start. Ultimately, the best way to know whether an IP will actually respond is to try to access it, and even then, different IPs will reply to different ports, based on their use. As well, you cannot know all IP ranges for a given name, especially for an international domain name like The reply will vary depending on the source IP of the query. But this is a start. – jfmessier Jul 8 '10 at 9:52

You could give robtex a shot, it's pretty comprehensive.

share|improve this answer
Seems it lists only a few IPs. – DenMark Jun 15 '10 at 9:35
If you look down the page a little for you'll find a table and a graph, click a link or two... – Pulse Jun 15 '10 at 9:43
Still, I can only see 4 A records, nothing more.. – DenMark Jun 17 '10 at 1:54

You must log in to answer this question.

protected by Community May 2 '13 at 8:38

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .