How to find out all DNS records of sites behind CloudFlare

How to list all DNS records for a domain

Using the dig command, you can display all types of DNS records for the specified domain at once, but it does not work in all cases:

dig zalinux.ru ANY

To query all types of DNS records, but limiting the number of displayed sections only by the response section, add the “+noall +answer” options:

dig zalinux.ru ANY +noall +answer

How to list all DNS records for a domain behind CloudFlare

It works fine in most cases. But for some sites in the DNS server settings it is forbidden to display a full list of records, examples of such sites are all sites behind CloudFlare.

As a result, for example, for the site hhzunt.top (hidden behind CloudFlare), the usual method fails to get the contents of DNS records:

dig hhzunt.top ANY

You can see the answer section, apparently it is a reference to some documentation:

hhzunt.top.		3787	IN	HINFO	"RFC8482" ""

Considering that requests for single records cannot be prohibited, and also taking into account that the number of DNS records is finite, you can enumerate them all one by one:

dig hhzunt.top A +short
dig hhzunt.top AAAA +short
dig hhzunt.top SOA +short
dig hhzunt.top MX +short

etc.

You can also use the online service on the w-e-b.site or SuIP.biz website, where a new method has been added to obtain all DNS records for a specific site. The essence of the method is a full enumeration; queries are made to the DNS server for each type of record. As a result, it is now possible to get a complete list of DNS records even for sites behind CloudFlare.

Service address: https://w-e-b.site/?act=alldns

Its mirror: https://suip.biz/?act=alldns

Enter the site address, select “Enumeration” as the method.

An example of getting all DNS records for a site behind CloudFlare:

DNS records SVCB and HTTPS are displayed for all sites – regardless of whether the system administrator set them or not. Their value repeats the contents of the A record.