Hacker News Reader

In the past, many DNS servers were configured so you can execute an "ls" to list the subdomains

Nowadays most have disabled that option.

Do you have any references for this functionality? I’ve never encountered something like that in the RFCs, or in any server.

I believe you're referring to DNS zone transfer (https://en.wikipedia.org/wiki/DNS_zone_transfer and https://serverfault.com/questions/890153/how-does-nslookup-l...).

So presumably nslookup -ls had some logic for finding the apex for a particular name, doing an AXFR and then filtering it to the the target name and below?

Yeah, I think it was for zone transfers. It was pretty fun discovering 'private' hosts :-)

Reply on news.ycombinator.com