Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Enumerating a DNS servers authoritative zones (was Question for DNS pros)
From: Bennett Todd <bet () rahul net>
Date: Fri, 23 Jul 2004 18:01:42 +0000

[ enumerate domains for which a nameserver publishes authoritative
  data ]

Even if the nameserver _did_ allow zone transfers, you _still_
couldn't enumerate its zones.

Even if you "parsed all registration sites" you'd still be nowhere
near there. Any subdomain at any depth can be delegated, by any
nameserver. And a server can offer authoritative data even if nobody
delegates it at 'em, this is sometimes a very useful technique, e.g.
declaring SOA for a classfully-aligned superset of your real
classless delegation in in-addr.arpa. And one of the more popular
top-level zones, .com, is jealously guarded as a secret by the lucky
bastards who stole it from the public domain, to prevent other folks
from stepping in and doing a more responsible job of managing
registry for the domain.

The place where this question rises routinely is in DNS server sets.
It's quite common within organizations to want to maintain sets of
domains across some collection of more or less independent
nameservers. DNS has a protocol within it, zone transfer, for
replicating the contents of a zone; not the best-designed protocol,
but occasionally useful. But as it has no mechanism for enumerating
the zones that would need to be transferred, some out-of-band
mechanism needs to be used to maintain the zone list; and once
that's in place, many folks note that using common off-the-shelf
components for replication works better than zone xfer even for the
zone data.

The one place zone xfer is handy is as a rendesvous point;
nameservers with different native zone data formats can share zone
xfer as a way to convert zones from one format to another.


Attachment: _bin

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]