find all hosts in a domain?

[Will Yardley]

On 2004-10-01, peter <nospam at nospam.com> wrote:

> Given an domain like www.company.com, how do I find all the publicly known 
> hosts in the same domain (e.g. host1.company.com, host2.company.com, ...)?
>
> I imagine some DNS server would contain this info.

If the authoritative DNS server(s) for the zone allows zone transfers,
you can use a tool like dig, host, or nslookup to transfer the entire
zone.

e.g.,
dig axfr @ns1.dreamhost.com dreamhost.com
(this will fail)

However most sites don't allow AXFR to hosts outside their network, or
hosts that don't need to be able to do zone transfers.

However, if transfers are refused, there's no easy way to do what you
ask, though there are probably some methods you could use to find most
or a lot of them in some cases.