My company runs an internal DNS for mycompany.example
There is a machine on the network that I need to find, but I’ve forgotten its name. If I could see a list, it would probably jog my memory.
How can I list all of the domain records for mycompany.example?
Answer
The short answer to your specific question of listing CNAMEs is that you cannot without permission to do zone transfers (see How to list all CNAME records for a given domain?).
That said, if your company's DNS server still supports the ANY query, you can use dig to list the other records by doing:
These ...
+noall +answer +multiline... are strictly optional and are simply output formatting flags to make the output more easily human readable (see dig man page).Example
Returns:
Caveats (RFC8482)
Note that, since around 2019, most public DNS servers have stopped answering most DNS
ANYqueries usefully. For background on that, see: RFC8482 - Saying goodbye to ANYIf
ANYqueries do not enumerate multiple records, the only option is to request each record type (e.g. A, CNAME, or MX) individually.A much easier command to remember (and more informative) is:
Which returns the following:
Try:
This may or may not work. Many DNS servers will deny a DNS Zone Transfer like this. For more information, see How the AXFR protocol works
You can also use
hostDNS lookup utility with-lswitch:Of course you need DNS zone transfer rights for this to work.
should give you all records. I write should because it depends on the DNS-Server used. dig gmx.de ANY with my Telekom-DNS DNS-Servers 217.237.148.102 17.237.151.115 and only gives
Whereas dig gmx.de MX gives
use dig gmx.de ANY @8.8.8.8 to query Google DNS and you get a long list.
However using QuadNine dig gmx.de ANY @9.9.9.9 we only get
So try different DNS-Servers to really get all DNS-Records or query for specific records directly.
The approach you're trying to use won't work. See this question for more information. Assuming you're the admin (if you're not please discuss this with your admin and read the FAQ before posting again) simply look up the zone file.
I found none of the answers so far would work for me, mostly due to zone transfer failures. This command did not run into that issue and presented me with something closer to what I get in the DNS Manager tool.
You can also use nslookup tool:
Using dig to see all records, first you need to know - DNS server where domain parking
(example for external dns)# dig @8.8.8.8 google.com ANY
(example for local dns) # dig @192.168.0.1 example.com ANY
I ended up using nmap to scan the network.
For example: