Finding all subdomains of any specific domain (DNS afxr)

It is possible to get list of all subdomains of any domain name. However, that must be allowed by the DNS Server. This is called AXFR. Step One: Getting authoritative nameserver(s) from linux shell dig domainname.com Now check the output in authority section. Let assume it is ns1.somehost.com. Now use the dig command as follow: [...]