How do I get a list of all subdomains of a domain?
dig, dns, nameservers, subdomain
Solution
The hint (using axfr) only works if the NS you're querying (`ns1.foo.example` in your example) is configured to allow AXFR requests from the IP you're using; this is unlikely, unless your IP is configured as a secondary for the domain in question.
Basically, there's no easy way to do it if you're not allowed to use axfr. This is intentional, so the only way around it would be via brute force (i.e. `dig a.example.com`, `dig b.example.com`, ...), which I can't recommend, as it could be viewed as a denial of service attack.
Problem
I want to find out all the subdomains of a given domain. I found a hint which tells me to dig the authoritative nameserver with the following option: ``` dig @ns1.foo.example example.com axfr ``` But this never works. Has anyone a better idea/approach?