Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know that it's probably (no longer) possible because of abuse, but I want to check nonetheless. Is there a way for me to obtain the company zone file for a domain myself, without having to contact the people who host the DNS for that domain?

Is there a way to get the complete zone file for a domain, without getting it from the company that hosts the DNS for that specific domain?

share|improve this question
add comment

5 Answers

up vote 22 down vote accepted

You can try to initiate a zone transfer.

You are right though, no sanely configured DNS server should still allow this nowadays which incidentally is why I can't provide you with current methods to accomplish this, but in the outdated nslookup utility, you could use ls [name of domain] to get the zone information.

A quick web search yielded the syntax to use with the utility dig:

dig @dns.example.com example.com -t AXFR

Though as I said, it probably won't work for you.

share|improve this answer
    
just a question: WHY do you think nslookup is outdated? Can you name some no-outdates alternatives? –  Novellizator Mar 25 '13 at 0:21
3  
@Novellizator: dig ? –  Kwaio Oct 1 '13 at 13:25
add comment

I'm not sure if this is exactly what you're looking for however Network-Tools.com solved my problem of wanting to see all the DNS records in the Zone file on a given nameserver:

http://network-tools.com/nslook/

share|improve this answer
    
This was very helpful to me. –  jerrygarciuh May 3 '13 at 15:18
add comment

Since your usual DNS queries are non-wildcard, your only options are:

  • ask politely for the whole list (aka zone transfer or call the admins - i.e. that what you wanted to avoid)
  • settle for an incomplete list

Hacking the server and just getting the config file usually is not an option, neither is eavesdropping on the zone transfers to the secondary/backup servers. Apart from those, there is no instance knowing all possible subdomains.

Options for getting incomplete lists:

  • send random queries (aka bruteforce, though you won't get very far - but perhaps some dictionary-style guessing might help you nonetheless)
  • ask google, using the "site:example.com" filter
  • use your own crawler to follow links, hoping that all subdomains you might be interested in are linked somehow. You'll probably miss smtp.example.com, though.

Also keep in mind some zone files do have wildcards themselves, so *.example.com might give you the address(es) of a web dispatcher configured to handle web1.example.com, sales.example.com, etc. differently. This works with all protocols which use the hostname not only in the IP-level but also in the application data stream. (e.g. name based virtual hosting for http)

share|improve this answer
    
'ask politely for the whole list (aka zone transfer or call the admins - i.e. that what you wanted to avoid)' Well, wanted to avoid... I have a couple of cases where I DID ask politely, and am entitled to the zonefile (on behalf of one of our customers), but STILL not getting it from the people sitting on the zonefile... :-/ –  Evert Aug 19 '09 at 10:17
add comment

I know this is a dated question, but I located the following website to obtain this information after stumbling across this question/answer: UltraTools Zone File Dump

In my testing, it was able to provide me with the information I required.

share|improve this answer
add comment

Not if their DNS is set up to disallow zone transfers (which is the recommended practice)

share|improve this answer
add comment

protected by Community May 18 at 2:42

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.