DNS on Windows Server 2003, 3rd Edition

Zone Transfers

You can use nslookup to transfer a whole zone with the ls command. This feature is useful for troubleshooting, for figuring out how to spell a remote host’s name, or just for counting how many hosts are in some remote zone. Since the output can be substantial, nslookup allows you to redirect the output to a file.

Beware: a lot of hosts won’t let you pull a copy of their zones, either for security reasons or to limit the load on their name server hosts.

nslookup filters zone transfer data: it shows you only some of the zone unless you tell it otherwise. By default, you see only address and name server data. You will see all of the zone data if you tell nslookup to display data of any type. The nslookup help (available from the Help and Support Center) or command summary (shown by typing help at the nslookup prompt) tells you all the parameters to the ls command. We are going to show only the -t parameter, since the others can be emulated with -t. The -t option takes one argument: the data type to filter. So, to pull a copy of a zone and see all the MX data, use ls -t mx. Let’s do some zone transfers:

C:\> nslookup 
Default Server:  terminator.movie.edu 
Address:  192.249.249.3 

> ls movie.edu.        
               List NS and A records for movie.edu. [terminator.movie.edu] movie.edu. NS server = terminator.movie.edu movie.edu. NS server = wormhole.movie.edu carrie A 192.253.253.4 diehard A 192.249.249.4 misery A 192.253.253.2 robocop A 192.249.249.2 shining A 192.253.253.3 terminator A 192.249.249.3 ...