How can I find all the domains a specific name server is hosting?

Question

How can I find out all the domains a specific name server is hosting? When evaluating shared web hosting services, it would be nice to be able to see how many other domains are being hosted on the same "box". Thanks!

Answer 1

Short answer: you can't.

First, it's better to clarify that a web server is different than a name server. Given the overall topic of your question, I believe you want to know how many web sites are running on a specific shared server.

The only way to know that is to ask the server owner.

A name server, instead, holds the DNS zones. Normally a name server is a completely different machine than a web server but I don't think this is the topic of this question, thus I'm skipping the details here.

In order to guess the number of sites running on a specific machine, you could try to search all the hostnames resolving to the machine IP. But because this service is not provided by any DNS server, you will need to use a third party service. And the result is not accurate, because you should have all existing hostnames resolved and stored, in order to provide the list of all the domains pointing to that IP.

You could run the same analysis on a domain, but again, there is no accurate service. The results would a guess, for the same reason above.

Last but not least, even assuming there is a service that tells you how many hostnames are resolving to that machine, then the machine can be a frontend proxy or a load balancer. In this case, you would never know how many machines are behing that cluster.

So the answer is, you can't.