domains

[roelof () SENSEPOST COM (Roelof Temmingh)]

Hi

Can anyone help me? I want to obtain all subdomains in a domain. Sounds very
simple eh? Let me first tell you what I have tried:

(let's assume i want list all the domains: *.com.my)

/tmp> nslookup
Default Server:  apollo.is.co.za
Address:  196.4.160.2

> set q=ns
> com.my
Server:  apollo.is.co.za
Address:  196.4.160.2

Non-authoritative answer:
com.my  nameserver = relay2.jaring.my
com.my  nameserver = gate1.jaring.my
com.my  nameserver = dns1.mynic.net.my
com.my  nameserver = jaring.my
com.my  nameserver = relay1.jaring.my

Authoritative answers can be found from:
relay2.jaring.my        internet address = 192.228.128.12
gate1.jaring.my internet address = 161.142.2.17
dns1.mynic.net.my       internet address = 192.228.180.2
jaring.my       internet address = 192.228.128.20
relay1.jaring.my        internet address = 192.228.128.11

Ok now I know i have to contact eg. jaring.my to get information about the
com.my subdomain. So I go there:

> server jaring.my
Default Server:  jaring.my
Address:  192.228.128.20

Now - let us assume that I want to get all the domains..I use the MX quertype,
assuming that all the domains have a MX record.

So I do a:
> ls -t mx com.my

I start getting answers:

[jaring.my]
##################..etc..it purs along nicely until:

..all of a sudden i get:

Received 30635 answers (522 records).
*** ls: error receiving zone transfer:
  result: NOERROR, answers = 1, authority = 0, additional = 0
*** Can't list domain com.my: Unspecified error

How come i get 30k+ answers, but only 522 records?

I have tried this with different domains and different servers, and I get the
same error *after a while*. I also tried it with

host -l com.my (or whatever), and get the same error..

What is the problem?

Any ideas, suggestions?
Regards,
Roelof.

------------------------------------------------------
Roelof W Temmingh               SensePost IT security
roelof () sensepost com         +27 83 448 6996
                http://www.sensepost.com