Getting the name of responding server(s)

[Stephane Bortzmeyer]

On Tue, Sep 07, 2021 at 10:48:57AM -0400,
 Matthew Pounsett <matt at conundrum.com> wrote 
 a message of 32 lines which said:

> Yeah, you can pretty reliably get the answer in one or two steps by
> requesting the NS set for the FQDN.  You'll either get your answer, or
> get an SOA with the name of the enclosing zone.  Second lookup gets
> you the NS set for the enclosing zone.

Indeed (unless you find a broken resolver that fail to send the SOA).

I was thinking of another issue: if the goal of the OP is to find
which domain names are on the same authoritative name servers, asking
the NS may not be sufficient, if a name server is known by several
names (for instance, a.nic.sex and a.nic.sucks are the same
machine). So, the OP may have to do a resolution of nameservers' names
into IP addresses, as well.