I know that it's probably (no longer) possible because of abuse, but I want to check nonetheless. Is there a way for me to obtain the company zone file for a domain myself, without having to contact the people who host the DNS for that domain?

Is there a way to get the complete zone file for a domain, without getting it from the company that hosts the DNS for that specific domain?

  • Did you try subdomainfinder.c99.nl?
    – Ale
    Commented Apr 4, 2023 at 16:13

7 Answers 7


You can try to initiate a zone transfer.

You are right though, no sanely configured DNS server should still allow this nowadays. Not just because as a zone admin you don't want to expose your internals but also because AXFR responses are way bigger than the queries, so they prove to be an excellent way for DoS reflection attacks as a <100 bytes spoofable UDP package can make a server send multiple KB of response to any machine on the internet.

If you still want to try:

In the nslookup utility, you can use ls [name of domain] to get the zone information.

And if you prefer dig, then you can use

dig @dns.example.com example.com -t AXFR

Though as I said, it probably won't work for you.

  • 2
    just a question: WHY do you think nslookup is outdated? Can you name some no-outdates alternatives? Commented Mar 25, 2013 at 0:21
  • 7
    @Novellizator: dig ?
    – mveroone
    Commented Oct 1, 2013 at 13:25
  • 4
    There was a period when nslookup was considered by ICS (Internet Systems Consortium) as outdated, decision was reversed in 2004 with the release of BIND 9.3. In fact you can find changes made during nslookup development even from this month. Commented Jul 24, 2015 at 17:31
  • How did people abuse it? All of the information is public anyway right? Commented Dec 30, 2015 at 10:47
  • 4
    @CMCDragonkai the problem is that DNS runs over UDP and thus is easily spoofable. So you can use this as a reflection attack for a DOS (send small query to server with spoofed sender, get huge response sent to victim). Plus a domain might contain internal addresses you don't want anybody to list.
    – pilif
    Commented Jan 4, 2016 at 12:26

I'm not sure if this is exactly what you're looking for however Network-Tools.com solved my problem of wanting to see all the DNS records in the Zone file on a given nameserver:


  • 9
    Just a warning, this doesn't actually include "all the DNS records in the Zone file"
    – Molomby
    Commented Nov 19, 2014 at 4:16
  • 7
    This doesn't answer the question that was asked. This lets you do a DNS lookup for a single domain name (e.g., www.yahoo.com). It doesn't download all of the records in a zone (e.g., all domains *.yahoo.com).
    – D.W.
    Commented Apr 14, 2016 at 23:32

Since your usual DNS queries are non-wildcard, your only options are:

  • ask politely for the whole list (aka zone transfer or call the admins - i.e. that what you wanted to avoid)
  • settle for an incomplete list

Hacking the server and just getting the config file usually is not an option, neither is eavesdropping on the zone transfers to the secondary/backup servers. Apart from those, there is no instance knowing all possible subdomains.

Options for getting incomplete lists:

  • send random queries (aka bruteforce, though you won't get very far - but perhaps some dictionary-style guessing might help you nonetheless)
  • ask google, using the "site:example.com" filter
  • use your own crawler to follow links, hoping that all subdomains you might be interested in are linked somehow. You'll probably miss smtp.example.com, though.

Also keep in mind some zone files do have wildcards themselves, so *.example.com might give you the address(es) of a web dispatcher configured to handle web1.example.com, sales.example.com, etc. differently. This works with all protocols which use the hostname not only in the IP-level but also in the application data stream. (e.g. name based virtual hosting for http)

  • 1
    'ask politely for the whole list (aka zone transfer or call the admins - i.e. that what you wanted to avoid)' Well, wanted to avoid... I have a couple of cases where I DID ask politely, and am entitled to the zonefile (on behalf of one of our customers), but STILL not getting it from the people sitting on the zonefile... :-/
    – Evert
    Commented Aug 19, 2009 at 10:17
  • 2
    In the case of some people (like 1and1) the support people don't even know what a zone file or zone transfer are, and just send canned replies for "how to transfer your domain registration". Um, no, that's not what I want. Commented Sep 14, 2015 at 3:57

The Internet Corporation for Assigned Names and Numbers (ICANN) created a handy service called the Centralized Zone Data Service (CZDS) which supports retrieval of complete zonefiles for selected domains.

The Centralized Zone Data Service (CZDS) is an online portal where any interested party can request access to the Zone Files provided by participating generic Top-Level Domains (gTLDs).

Zone file access provides anticrime organizations, businesses, cybersecurity professionals, law enforcement, and researchers with a means to download the entire zone file "in bulk." These organizations apply the bulk zone data to combat phishing, spam, brand and trademark infringements, and other malicious uses of domains.

  • I tried setting up an account with CZDS. It requires you enter your address, phone numbers, and an SFTP IP. What is the SFTP IP? I don't have an SFTP server. Is this a requirement to own one, just to get a list of DNS records? Commented Sep 22, 2021 at 21:38
  • @JohnLittle It requires just the IP address from which you will connect to the relevant SFTP server, for enforcing access limits. See czds.icann.org/help for details. Commented Mar 21, 2022 at 1:16
  • You also don't have to provide an SFTP server, you can just download the data from within the web interface.
    – Deckard
    Commented Apr 10 at 7:33

I know this is a dated question, but I located the following website to obtain this information after stumbling across this question/answer: UltraTools Zone File Dump

In my testing, it was able to provide me with the information I required.

  • 7
    This won't work for most domains. This website just tries an AXFR transfer, as mentioned in pilif's answer, but as pilif's answer explains, that usually won't work. So, unfortunately, this answer adds little value over pilif's answer, and should be written to explain the caveats.
    – D.W.
    Commented Apr 14, 2016 at 23:34

I've had a similar demand - to check for a domain transfer capabilities on multiple domains with one shot. I've created a web-based tool that allows a domain list (or URLs list) as an input. Additionally all successful transfers are archived so that You would be able to see if domain zone content changes overtime.

The project is a freeware hosted on github here: Medved

A bit longer descriptipn is available at my blog.

This is how it looks like: enter image description here

Basically You just supply the list of comma-separated list of domains to check and hit a button Analyze. Each domain will have a separate result section with separate tab for each NS server. Green color of server name will indicate a successful transfer. Orange indicate that most probably the TCP port 53 is closed on a remote host (TCP is required for domain transfers). Red server name color indicates that server actively refuses the domain transfers - that means it is properly configured.

The tool has a bit more useful features that are described in detail in the help section:

enter image description here


Mail exchangers, SPF, and others

Although it seems obvious, I find the hardest part about moving a domain is usually something related to the email setup. To this end, maybe it would help to know about the ANY, TXT, MX and SOA options in dig, as I didn't see this mentioned as yet by anyone. While I wouldn't recommend anything other than getting the zone-file straight from the horses mouth, if you are in desperado mode and feel the need for speed you might wanna try mx, soa, txt, and any options, but you will miss all sub-domains in my case it is not obvious to discover the sub-domain lists.triptonites.com which requires mail service.

Notice how the following all give slightly different info that is not obvious

dig any triptonites.com # mite not work
dig mx  triptonites.com # for email to work
dig soa triptonites.com # for email abuse / admin
dig txt triptonites.com # for SPF authentication / anti-spam
dig any lists.triptonites.com # shows RFC8482 warning sometimes / always
dig mx  lists.triptonites.com # etc as above it shows you'd likely miss records trying to hack this info out
dig soa lists.triptonites.com
dig txt lists.triptonites.com

These all give useful info that could get missed from a casual hack using nslookup and dig etc.

Also, I did it too many times and the server gave an abuse response:

lists.triptonites.com.  3789    IN      HINFO   "RFC8482" ""

This is another sign this approach is a bit wrong/risky, it's not the correct reply, it's a message about minimal replies and that I should try these using mx, txt and soa instead of any.

  • ANY never meant ALL so it is a dead end, and now there is even a specification to allow nameservers to not reply to those queries. RFC8482 indeed. ANY was never understood correctly (it just gives all the records the recursive nameserver has learned about, what it has in its cache, which is absolutely not ALL records in the given zone/for the given domain), hence its full deprecation now. Nothing should depend on it. Commented Mar 21, 2022 at 1:11
  • " I find the hardest part about moving a domain is usually something related to the email setup. " And in that department, things are even more complex than what you list. You may need to handle DMARC hence use the _dmarc name TXT record. You may also need to cater for DKIM keys which are also TXT records but under names you can not determine per se, so without access to the zonefile, you are blocked. Commented Mar 21, 2022 at 1:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .