Geek request

[mattlistener]

I have several domains that I need to transfer to our DNS servers from non-responsive ISPs. We own and have control of the domain registrations so that is not an issue.

The question: is there a command I can issue that will spit back for me the entire zone file currently being served for a domain?

My intention is to turn that output (appropriately modified for local needs) into the zone file we will then serve for the domain. The idea being of course to make the change without causing any outages in devices that have hostnames in that domain.

Thanks!

Comments

[beowabbit]

Yes, if the DNS server lets you. These days, a DNS server is generally configured only to let its secondaries list the zone.

You can do it in nslookup on Solaris like this:

$ nslookup
> server ns.domain.tld
> ls -d domain.tld
...
ypmaster 1H IN CNAME fnord
za 1H IN CNAME zhuang
zeus 1H IN MX 10 bogon
1H IN MX 50 avocado
...
> ls -d domain.tld > /tmp/zonefile
[ns.domain.tld]

Received 2203 answers (0 records).
> exit

That will list the zone file on the screen, and then (with "> /tmp/zonefile") save it in a file. You'll probably need to tweak it by hand a bit.

However, (1) as mentioned above, the DNS server probably won't let you do this, and (2) the "nslookup" binary I have on my Linux machines doesn't support the "list" command. I took a quick look at the help for the "dig" command and didn't see a corresponding option.

If the DNS server *does* let you list the domain, but you don't have access to an nslookup command that lets you, you should be able to get zone files by setting up your local DNS server to secondary the domain from the ISP's DNS server. That's basically what secondarying is -- copying the zone files.

[mattlistener.livejournal.com]

Thanks! :-)

[redknight.livejournal.com]

I'm not intimately familiar with nslookup, but it sounds like the "ls" feature is just doing a zone transfer. To do a transfer using dig, the syntax is "dig axfr example.com @ns1.example.com" (substituting the real domain name and real authoritative server for example.com and ns1.example.com).

As beowabbit notes, many DNS servers these days are locked down such that only authorized secondary servers can perform a zone transfer.