List DNS subdomains

[CubanCorona]

If I have a domain such as microsoft.com and I want to see all of the subdomains, can I do this? In other words, how do you ask a DNS server, "What subdomains do you know about for this domain?"

I think this has an easy answer, but I haven't been able to find it. Maybe it can't be done...

 

[GreyMittens]

You could try to request a zone transfer from them in nslookup
ls -d domain.com > zone.txt

Most will likely refuse unauthorized hosts.

 

[randal]

depends on whether or not the server is will to do an AXFR to your IP address. If not, it won't list anything besides the answer for the exact query you asked it.

If you run nslookup, type in `server {thenameserver}` then type in `ls -d domain.com` it will attempt to get thenameserver to provide a list of all hosts that it knows about -- including sub domains -- of domain.com. Example output looks like this:

Default Server: anubis.data102.com
Address: 38.97.208.2

> ls -d data102.com
[anubis.data102.com]
data102.com. SOA ns1.data102.com hostmaster.data102.com. (
2005102801 3600 900 604800 300)
data102.com. NS ns1.data102.com
data102.com. NS ns2.data102.com
data102.com. A 69.67.108.14
data102.com. MX 10 mail.data102.com
data102.com. MX 20 backup.data102.com
demo CNAME isis.data102.com
quakecon A 38.97.208.2
...
Lots more output
...


When it doesn't work, it looks like this (on BIND)

> server 69.67.108.3
Default Server: anubis.data102.com
Address: 69.67.108.3
> ls -d data102.com
[anubis.data102.com]
*** Can't list domain data102.com: Query refused
>