My company runs an internal DNS for mycompany.example
There is a machine on the network that I need to find, but I’ve forgotten its name. If I could see a list, it would probably jog my memory.
How can I list all of the domain records for mycompany.example
?
Best Answer
Answer
The short answer to your specific question of listing CNAMEs is that you cannot without permission to do zone transfers (see How to list all CNAME records for a given domain?).
That said, if your company's DNS server still supports the ANY query, you can use dig to list the other records by doing:
These ...
+noall +answer +multiline
... are strictly optional and are simply output formatting flags to make the output more easily human readable (see dig man page ).Example
Returns:
Caveats (RFC8482)
Note that, since around 2019, most public DNS servers have stopped answering most DNS
ANY
queries usefully. For background on that, see: https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/If
ANY
queries do not enumerate multiple records, the only option is to request each record type (e.g. A, CNAME, or MX) individually.