How to find all hostnames in DNS attached to one IP?

Not really, no. This is all about the difference between forward and reverse DNS lookups.

A forward lookup is the standard name->IP lookup. So, you would have to know all the names in advance.

What you want is to do an IP->name lookup, but somehow get all the names you’ve applied in your Apache config and in DNS as A records (or CNAMES or whatever).

What you will probably find is that doing a reverse lookup (e.g. dig @nameserver $ip -x) will return the hostname given to that IP by the people who own that netblock, which could be your ISP. It might have a name like 45-23-45-231.big-isp.com, which doesn’t mean a whole lot to you. And crucially, there is only one reverse record, but potentially many forward ones.

I suppose it boils down to the question – how does the reverse zone know about any of the records in the forward zone? In most setups, the forward zone is made available to the customer to make changes to, but the reverse zone is maintained by the owners of the netblock. The two systems don’t need to know anything about each other to function.

Leave a Comment