First find out the NS (name servers) for the domain (in here we use infoblender.com as an example)
Result:
dig infoblender.com ns ; <<>> DiG 9.10.6 <<>> infoblender.com ns ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58413 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;infoblender.com. IN NS ;; ANSWER SECTION: infoblender.com. 600 IN NS dns2.commentum.com. infoblender.com. 600 IN NS dns1.commentum.com. ;; Query time: 30 msec ;; SERVER: 2001:578:3f::30#53(2001:578:3f::30) ;; WHEN: Thu Jan 05 17:03:31 PST 2023 ;; MSG SIZE rcvd: 92
Now that we know the name server for the domain infoblender.com, we will need to find the IP address for one of the name servers:
Result:
dig dns2.commentum.com ; <<>> DiG 9.10.6 <<>> dns2.commentum.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53333 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;dns2.commentum.com. IN A ;; ANSWER SECTION: dns2.commentum.com. 600 IN A 208.66.58.9 ;; Query time: 28 msec ;; SERVER: 2001:578:3f::30#53(2001:578:3f::30) ;; WHEN: Thu Jan 05 17:07:24 PST 2023 ;; MSG SIZE rcvd: 63
Now that we have the IP addresses of the name servers that are responsible for that domain, we will use one of the name server's IP and the following command to get the list of all records for that domain - for example:
You can repeat the same dig command for other subdomains like below:
Important Note: If you do not know the list of all subdomains (for example: www.infoblender.com, mail.infoblender.com, ftp.infoblender.com, etc.., then it will not be possible to get the list of all records including all the records for any subdomain for a domain. Then you will need access to that domain's DNS servers in order to get all of the records including the subdomains
