Sometimes, we need to know about all subdomains of a domain, for example, we want to know all subdomains of itb.ac.id, we can do this step :
Locate your primary nameserver, for example, in my campus the master nameserver is 167.205.22.123 / ns2.itb.ac.id we can listing the registered subdomains in ns2.itb.ac.id by following this command :
# dig @167.205.22.123 itb.ac.id axfr
; <<>> DiG 9.4.2-P2 <<>> @167.205.23.1 itb.ac.id axfr
; (1 server found)
;; global options: printcmd
itb.ac.id. 3600 IN SOA ns1.ITB.ac.id. dnsadm.ITB.ac.id. 2009031102 3600 3600 1209600 3600
itb.ac.id. 3600 IN NS ns3.itb.ac.id.
academic.itb.ac.id. 3600 IN A 167.205.27.102
ae.itb.ac.id. 3600 IN NS ns2.itb.ac.id.
ae.itb.ac.id. 3600 IN NS ns3.itb.ac.id.
ai3.itb.ac.id. 3600 IN NS ns2.itb.ac.id.
ai3.itb.ac.id. 3600 IN NS ns3.itb.ac.id.
ai3-indonesia-ether.itb.ac.id. 3600 IN A 167.205.23.2
ai3-indonesia-ether.itb.ac.id. 3600 IN A 202.249.24.67
ai3-indonesia-ether.itb.ac.id. 3600 IN AAAA 2001:d30:3::218:71ff:fe87:1cc3
ai3-indonesia-ether.itb.ac.id. 3600 IN AAAA 2001:d30:103:3000:218:71ff:fe86:c773
AI3-NOC-PAU-Cat6-Vlan.itb.ac.id. 3600 IN CNAME indonesia-itb-ether.itb.ac.id.
akademik.itb.ac.id. 3600 IN NS ns2.itb.ac.id.
akademik.itb.ac.id. 3600 IN NS ns3.itb.ac.id.
akademik.itb.ac.id. 3600 IN NS mail.akademik.itb.ac.id.
mail.akademik.itb.ac.id. 3600 IN A 167.205.110.2
mail.akademik.itb.ac.id. 3600 IN A 167.205.110.131
alumni.itb.ac.id. 3600 IN A 167.205.1.73
alumni.itb.ac.id. 3600 IN MX 10 1348379770.pamx1.hotmail.com.
.
.
.
zimbra.itb.ac.id. 3600 IN A 167.205.23.23
zimbra.itb.ac.id. 3600 IN MX 5 mx1.itb.ac.id.
zimbra.itb.ac.id. 3600 IN MX 10 zimbra.itb.ac.id.
registrasi.zimbra.itb.ac.id. 3600 IN A 167.205.23.23
itb.ac.id. 3600 IN SOA ns1.ITB.ac.id. dnsadm.ITB.ac.id. 2009031102 3600 3600 1209600 3600
;; Query time: 310 msec
;; SERVER: 167.205.23.1#53(167.205.23.1)
;; WHEN: Mon Mar 16 14:24:00 2009
;; XFR size: 1157 records (messages 1, bytes 27118)
you can try another domains for example arc.itb.ac.id to be searched all of its subdomains
# dig @167.205.22.123 arc.itb.ac.id axfr
; <<>> DiG 9.4.2-P2 <<>> @167.205.22.123 arc.itb.ac.id axfr
; (1 server found)
;; global options: printcmd
arc.itb.ac.id. 2592000 IN SOA gtw.arc.ITB.ac.id. admin.arc.itb.ac.id. 2009031209 3600 900 1728000 3600
arc.itb.ac.id. 2592000 IN AAAA 2001:d30:3:160::3
arc.itb.ac.id. 2592000 IN A 167.205.3.3
arc.itb.ac.id. 2592000 IN MX 10 arc.itb.ac.id.
arc.itb.ac.id. 2592000 IN MX 100 mx1.itb.ac.id.
arc.itb.ac.id. 2592000 IN NS gtw.arc.ITB.ac.id.
arc.itb.ac.id. 2592000 IN NS ns2.itb.ac.id.
arc.itb.ac.id. 2592000 IN NS ns3.itb.ac.id.
10.arc.itb.ac.id. 2592000 IN A 167.205.3.52
11.arc.itb.ac.id. 2592000 IN A 167.205.3.53
12.arc.itb.ac.id. 2592000 IN A 167.205.3.54
13.arc.itb.ac.id. 2592000 IN A 167.205.3.55
14.arc.itb.ac.id. 2592000 IN A 167.205.3.56
15.arc.itb.ac.id. 2592000 IN A 167.205.3.57
16.arc.itb.ac.id. 2592000 IN A 167.205.3.58
17.arc.itb.ac.id. 2592000 IN A 167.205.3.59
18.arc.itb.ac.id. 2592000 IN A 167.205.3.60
19.arc.itb.ac.id. 2592000 IN A 167.205.3.61
.
.
.
It’s very simple