Finding all subdomains of any specific domain (DNS afxr)

It is possible to get list of all subdomains of any domain name. However, that must be allowed by the DNS Server. This is called AXFR.

Step One: Getting authoritative nameserver(s) from linux shell

dig domainname.com

Now check the output in authority section. Let assume it is ns1.somehost.com. Now use the dig command as follow:

dig @ns1.somehost.com domainname.com axfr

If it is allowed, you should see all the sub-domains under the domain domainname.com. If it has multiple DNS servers, you may try one after another as long as you did not reach your goal.

Related posts:

1. The dos and don’ts of domain registration
2. How to transfer a domain name
3. How to point a sub-domain to a different IP Address or Server?
4. How to edit DNS zone (A, CNAME, TXT) in cPanel (not in WHM) as End User (Domain Owner)
5. Delete some specific files from all subdirectories