6

For example, suppose I want to list all third-level domains of google.com. That list should look like

 translate.google.com
 plus.google.com

etc. Is it possible to get that list for an arbitrary second-level domain?

Adobe
  • 12,967
  • 10
  • 85
  • 126
  • There are a variety of tool which list subdomains, like https://www.nmmapper.com/sys/tools/subdomainfinder/ - but they cannot guarantee that they know about *all* subdomains. And if a domain is used for DNS Tunneling, the list of subdomains may be "all possible subdomain names for that domain". – Klaws Mar 29 '21 at 08:07

1 Answers1

1

In practice, no.

It may be possible for a specific domain, if the owner of the domain felt like it. Find the name servers for the domain in question (dig ns google.com), then ask one of them for a zone transfer (dig axfr google.com @ns1.google.com) and see if you get a list of names or a short error message.

Calle Dybedahl
  • 5,228
  • 2
  • 18
  • 22