dnssubdomaindignameservers

How do I get a list of all subdomains of a domain?

I want to find out all the subdomains of a given domain. I found a hint which tells me to dig the authoritative nameserver with the following option:

dig @ns1.foo.example example.com axfr

But this never works. Has anyone a better idea/approach?

Solution

  • The hint (using axfr) only works if the NS you're querying (ns1.foo.example in your example) is configured to allow AXFR requests from the IP you're using; this is unlikely, unless your IP is configured as a secondary for the domain in question.

    Basically, there's no easy way to do it if you're not allowed to use axfr. This is intentional, so the only way around it would be via brute force (i.e. dig a.example.com, dig b.example.com, ...), which I can't recommend, as it could be viewed as a denial of service attack.