blocks|key|357137|text|它曾经可以通过以下方式实现：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|357138|host+-a+-l+domain.com|code-block|syntax|javascript|357139|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

It used to be possible with:

<pre><code>host -a -l domain.com
</code></pre>

blocks|key|3354799|text|使用区域传输，即：(在nslookup中)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3354800|ls+-d+google.com|3354801|如果您有自己的DNS服务器，则会有区域复制安全设置(通常按IP)。否则，就试一试，看看它是否有效。|3354802|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

Using zone transfer, i.e.:
(in nslookup)

ls -d google.com

If you have your own DNS server, there will be zone transfer security settings (usually by IP). Otherwise, just try it and see if it works.

blocks|key|3141841|text|就像其他人所说的，你想要的是所谓的区域转移。如果它是您自己的域，您可以配置DNS服务器将其提供给您。如果它是针对其他域的，您可能不会得到它，因为大多数DNS管理员认为它是一个安全威胁。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3141842|即使一个单独的记录不是问题(因此这就是DNS+)，如果一个邪恶的人获得了您所有记录的列表，这也可能是一个问题:它可以简化攻击。|3141843|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Like others have said, what you want is a so called zone-transfer. If it is your own domain you can configure the DNS server to give it to you. If it is for some other domain you probably don't get it, since most DNS-admins consider it a security threat.

Even if an individual record isn't a problem (thats what the DNS it therefore) it could be a problem if an evil person gets a list of all your records: It could simplify an attack.

blocks|key|3141954|text|防止区域传输是服务器管理的一项功能，正如其他人所说，由于安全原因，目前通常是禁用的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3141955|当需要添加DNSSEC时，请确保使用新的NSEC3格式记录(来自RFC+5155)，而不是原来的NSEC格式，因为后者允许区域枚举。|offset|length|style|CODE|3141956|请注意，防止区域枚举实际上只是通过模糊性实现安全性。如果有人找到您的子域，您仍然需要在应用层提供额外的安全性。|3141957|至于您的示例记录：|3141958|www+IN+CNAME+domain.com.
subdomain1+IN+CNAME+domain.com.
subdomain2+IN+CNAME+domain.com.+
subdomain1+IN+A+123.4.56.78.
subdomain2+IN+A+123.4.56.79.|code-block|syntax|javascript|3141959|3141960|您不能在同一实体中混合使用CNAME记录和其他RRtypes+|ordered-list-item|3141961|A记录中的尾随点无效|3141962|最好不要将CNAME用回域中的WWW记录|3141963|3141964|您需要：|3141965|$ORIGIN+domain.com
@++++++IN+SOA+...
+++++++IN+A+++123.4.56.78
www++++IN+A+++123.4.56.78
sub1+++IN+A+++123.4.56.79|3141966|(其中sub1.domain.com是隐藏的站点)|3141967|entityMap|0|LINK|mutability|MUTABLE|url|http://tools.ietf.org/rfcmarkup?doc=5155^0|0|K|5|1C|4|W|8|0|0|0|0|0|0|0|0|0|0|0|0|3|F|0^^$0|@$1|2|3|4|5|6|7|1D|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1E|8|@$D|1F|E|1G|F|G]|$D|1H|E|1I|F|G]]|9|@$D|1J|E|1K|1|1L]]|A|$]]|$1|H|3|I|5|6|7|1M|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|1N|8|@]|9|@]|A|$]]|$1|L|3|M|5|N|7|1O|8|@]|9|@]|A|$O|P]]|$1|Q|3|-4|5|6|7|1P|8|@]|9|@]|A|$]]|$1|R|3|S|5|T|7|1Q|8|@]|9|@]|A|$]]|$1|U|3|V|5|T|7|1R|8|@]|9|@]|A|$]]|$1|W|3|X|5|T|7|1S|8|@]|9|@]|A|$]]|$1|Y|3|-4|5|6|7|1T|8|@]|9|@]|A|$]]|$1|Z|3|10|5|6|7|1U|8|@]|9|@]|A|$]]|$1|11|3|12|5|N|7|1V|8|@]|9|@]|A|$O|P]]|$1|13|3|14|5|6|7|1W|8|@$D|1X|E|1Y|F|G]]|9|@]|A|$]]|$1|15|3|-4|5|6|7|1Z|8|@]|9|@]|A|$]]]|16|$17|$5|18|19|1A|A|$1B|1C]]]]

Preventing zone-transfers is a function of the server administration, and as others have said is typically disabled these days for security reasons.

When the time comes to add DNSSEC, make sure you use the new <code>NSEC3</code> format records (from <a href="http://tools.ietf.org/rfcmarkup?doc=5155" rel="nofollow noreferrer">RFC 5155</a>) rather than the original <code>NSEC</code> format as the latter allows for zone enumeration.

Note that preventing zone enumeration really is just security-via-obscurity. If someone finds your subdomain you'll still need additional security at the application layer.

As for your example records:

<pre><code>www IN CNAME domain.com.
subdomain1 IN CNAME domain.com.
subdomain2 IN CNAME domain.com. 
subdomain1 IN A 123.4.56.78.
subdomain2 IN A 123.4.56.79.
</code></pre>

<ol>
<li>You can't mix CNAME records and other RRtypes in the same entity</li>
<li>The trailing dots in the A records are invalid</li>
<li>It's best not to use a CNAME back to the domain for the WWW record</li>
</ol>

You need:

<pre><code>$ORIGIN domain.com
@ IN SOA ...
 IN A 123.4.56.78
www IN A 123.4.56.78
sub1 IN A 123.4.56.79
</code></pre>

(where <code>sub1.domain.com</code> is the hidden site)

blocks|key|3141977|text|如果域名服务器允许区域传输，您可以使用此页面的http://www.magic-net.info/dns-lookup.dnslookup查找给定区域中的所有子域。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3141978|10月15日我已经修改了我的工具。现在它检查前6个域名服务器的区域传输，如果没有人允许区域传输，则使用搜索引擎Reverse+lookup+and+subdomains+search|3141979|entityMap|0|LINK|mutability|MUTABLE|url|http://www.magic-net.info/dns-lookup.dnslookup|1|http://www.magic-net.info/dns-and-ip-tools.dnslookup^0|N|1A|0|0|1J|10|1|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]]|C|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@$A|U|B|V|1|W]]|C|$]]|$1|F|3|-4|5|6|7|X|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]|N|$5|I|J|K|C|$L|O]]]]

If name servers allow zone transfers you can use this page <a href="http://www.magic-net.info/dns-lookup.dnslookup" rel="nofollow noreferrer">http://www.magic-net.info/dns-lookup.dnslookup</a> to find all subdomains in given zone.

15 oct. I`m have modified my tool. Now it checks first 6 name servers for zone transfers and, if no one allow zone transfers, uses search engeines <a href="http://www.magic-net.info/dns-and-ip-tools.dnslookup" rel="nofollow noreferrer">Reverse lookup and subdomains search</a>

<blockquote>
 This question exists because it has
 historical significance, but it is not
 considered a good, on-topic question
 for this site, so please do not use it
 as evidence that you can ask similar
 questions here.
 
 More info: <a href="https://stackoverflow.com/faq">https://stackoverflow.com/faq</a>
</blockquote>

Anyone knows if it's possible to find all A records, CNAME or subzone records configured for a domain name?

For example, domain.com:

<pre><code>www IN CNAME domain.com.
subdomain1 IN CNAME domain.com.
subdomain2 IN CNAME domain.com. 

subdomain1 IN A 123.4.56.78.
subdomain2 IN A 123.4.56.79. 
</code></pre>

I want to keep a sub-domain private where I'll run an admin application (it will be password protected and on a special port, but I would prefer to keep it as private as possible).

Is it possible to find all DNS subdomains for a given domain name?

服务器

这个问题之所以存在，是因为它具有历史意义，但对于本网站来说，它不是一个很好的主题问题，所以请不要将它作为您可以在此处提出类似问题的证据。更多信息：有没有人知道是否有可能找到为一个域名配置的所有A记录、CNAME或分区记录？例如，domain.com：www IN CNAME domain.com.subdomain1 ...

问是否可以找到给定域名的所有DNS子域？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问是否可以找到给定域名的所有DNS子域？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问是否可以找到给定域名的所有DNS子域？
EN