26

If I have multiple hosts configured on one machine (a la apache's VirtualHosts), how can I do a lookup on the IP and find all domains configured to reach it?

For example, I have several web and email domains hooked-to my server. How can I find all domains that point to it?

Is it even possible?

I have DNS A entries for all the domains I own, plus I know some friends' domains point to my server. What I'd like to see is if folks I don't know about are pointing there, too. (Or if someone has repointed their domain elsewhere, and I can delete their 'old' website from my server.)

warren
  • 17,829
  • 23
  • 82
  • 134

5 Answers5

33

Not really, no. This is all about the difference between forward and reverse DNS lookups.

A forward lookup is the standard name->IP lookup. So, you would have to know all the names in advance.

What you want is to do an IP->name lookup, but somehow get all the names you've applied in your Apache config and in DNS as A records (or CNAMES or whatever).

What you will probably find is that doing a reverse lookup (e.g. dig @nameserver $ip -x) will return the hostname given to that IP by the people who own that netblock, which could be your ISP. It might have a name like 45-23-45-231.big-isp.com, which doesn't mean a whole lot to you. And crucially, there is only one reverse record, but potentially many forward ones.

I suppose it boils down to the question - how does the reverse zone know about any of the records in the forward zone? In most setups, the forward zone is made available to the customer to make changes to, but the reverse zone is maintained by the owners of the netblock. The two systems don't need to know anything about each other to function.

13

It's not possible to do it with the DNS protocol itself, because typically there's only one PTR record for each IP address, even though there may be many A records pointing at that IP address.

However some companies (e.g. http://www.ip-adress.com/) have managed to compile databases containing what you're after by storing the results of a whole load of DNS lookups and then offering a reverse-query into their own databases.

Those databases can't be definitive though, they can't guarantee to know about every possible domain that might happen to point at that IP - they can only record the DNS details for the domain names that they've actually looked up.

Alnitak
  • 20,901
  • 3
  • 48
  • 81
  • that's what I was afraid of.. darn :-| – warren Jan 22 '10 at 01:45
  • 1
    Just a heads-up that I've yet to come across such a lookup service which handles all TLDs. In fact all those I've tried failed to list .com.au domains, even when hosted on the same server as .com domains. – John Gardeniers Jan 25 '10 at 01:02
  • 2
    odd - there's no reason a service like this should even care which TLD the site is on. That said, as I mentioned, the databases only know about sites that people ask about - I guess not enough people care about .com.au domains ;-) – Alnitak Jan 25 '10 at 17:30
4

The only way to do this, is to have content data of domain name you want to inspect.

With this content you can devellop a recursive script to search hostname relative to your IP (recursive because of eventual CNAME to check).

To get data of some domain name partner, you can ask to be secondary and get DATA with a dig -t axfr.

profy
  • 1,126
  • 9
  • 19
3

I think you're coming at this from the wrong direction. Aside from either a) querying every DNS server in existence for every possible domain name and then storing the result or b) getting zone transfers from the DNS servers you're interested in, there's no way to do this with DNS.

Well, if you're running Apache name-based vhosts, you already have a list of domains that will reach your server. Aside from the default vhost, a name-based vhost will only answer for its' name. So if I point foobar.com at my box, and don't have a foobar.com vhost, it'll either be served by the default or not get answered (if you don't have a default server).

Apache has some very powerful logging features. It shouldn't be a problem to define a custom log format with the request lines you want. Also, there's always the referrer field.

Mail, on the other hand, is a bit more of a pain. About the best thing I can think of is to pick what you can from the server logs and, if you really need to know, setup a packet capture for SMTP.

Jason Antman
  • 1,546
  • 1
  • 12
  • 23
  • with apache vhosts I only know what paths I'm handing-out to *specific* domains... not all the domains that are configured: if you point mynewdomain.tld to my server, since there is no vhost entry, apache will just return the default webroot – warren Jan 25 '10 at 21:15
  • 1
    picking-through the logs could work, though - hadn't thought about that as a way of doing it on the server itself. – warren Jan 25 '10 at 21:16
  • `LogFormat %{Host}i hostnamelog`, then `CustomLog /path/to/log hostnamelog` in your default VHost, making sure it's separate from any of your "real" VHosts. Then occasionally `sort /path/to/log | uniq -c | sort -n` for insight into what's hitting you. – BMDan Feb 21 '11 at 18:57
2

You should check for RobTex Not the best web design, but very useful ! You can find out all the DNS associated to an IP.

Of course, as explained Alnitak,

It's not possible to do it with the DNS protocol itself

That means that this website is just a huge database of most DNS/IP servers. That's pretty efficient but not 100% exhaustive.

Community
  • 1
Bonswouar
  • 131
  • 5