How to get from a name server all A records pointing to a specific IP

Question

How can I get from a specific name server, say ns.example.com, all A records pointing to a specific IP x.y.z.w ??

I've been trying with reverse DNS lookup tools, but I cant manage to get what I need.

Do you have access to the server? What OS and DNS server is the server running? What OS are you running? — MDMarra, Aug 17 '10 at 19:02
No, I dont have access to it. Otherwise, I could just do what Chris suggests. — GetFree, Aug 17 '10 at 19:13
right, that's why I asked. My comment was posted before his answer... — MDMarra, Aug 17 '10 at 19:24

score 3 · Accepted Answer · answered Aug 17 '10 at 19:00

3

Remotely: that would require a zone transfer, which will be blocked unless security on the server was configured very poorly.

Locally: You can open the zone file and grep through it.

answered Aug 17 '10 at 19:00

Chris S

77,945
11
124
216

Yes, remotely. It's not one of my servers – GetFree Aug 17 '10 at 19:04
That'd be "no", it ain't happening. – Chris S Aug 17 '10 at 19:28

score 1 · Answer 2 · answered Aug 17 '10 at 19:26

This is impossible.

If you had admin access to the server in question you could grep the configuration files, but within the DNS protocol you just can't do it.

Even AXFR isn't sufficient, since even if it's enabled, you'd have to know every single domain name being served from that server.

score 0 · Answer 3 · answered Aug 17 '10 at 21:56

The simple answer is No. I have seen a site that claimed to do this, but it didn't serve all the A records for cases where I knew some of the answer.

The PTR records used for reverse DNS records belong to different zones than the related A records. They may note be administered in the same DNS servers or by the same organizaations. It is possible that several DNS administrations have A records pointing to the same IP address. The DNS admimistrator for the PTR records may well be unaware of at least some of them.

There are a number of services offering Dynamic DNS. It would be extremely rare for the PTR to match A record. In many case there is no PTR record for the IP address.

For properly configured mail servers there will be a PTR record matching the A record for the mail service. This may not be the only A record for the server. It has been my experience that most spam comes from IP addresses where the PTR record does not match the A record, and in many case at least one record is missing.

If an address is also used for virtual Web servers, there will be more than one A record. These may be spread across a number of domains, and the various DNS aministrators may be unware that others are using the same IP address.

How to get from a name server all A records pointing to a specific IP

3 Answers3