Does a.gtld-servers.net have a list of all .com domains?
When I do dig @a.gtld-servers.net example.com
, it quickly returns the
nameservers for example.com
and the IP addresses for those nameservers
(glue records).
Does that mean a.gtld-servers.net
(and *.gtld-servers.net
) have a
record of all .com
domains locally? They respond very quickly, so I
don't think they're making a further query themselves. Similarly, a
request for example.com
's nameservers doesn't redirect me to
domains.starting.with.e.gtld-servers.net
or anything.
I do realize a.gtld-servers.net
is probably several machines and that
I'm being routed to the one nearest me (through that new
one-ip-multiple-machine technology), but this would just mean several
other machines have all .com
domains.
EDIT: Thanks to everyone who answered! Followup question: if someone "hacks into" one of these machines, couldn't they get a list of all .com
domains? This seems like useful information, unless it's already available somewhere for free? I realize domain information is public, but is still difficult to obtain in bulk. I'm guess *.gtld-servers.net
don't support zone transfers (though .edu
's nameservers did, at least a few years ago).
NOTE: I realize example.com isn't an actual domain-- just replace it with any other .com domain above (I originally had xyz.com, but someone correctly edited it to avoid using a real domain name).
Yes, the "x.gtld-servers.net" are the authoritative servers for the "com" top level domain, so they have all the "pointers" for the .com domains. You can see the nameservers for the TLD by running
dig -t ns com
dig -t ns us
dig -t ns dk
dig -t ns aero
Do a query for the domain itself – dig @a.gtld-servers.net com.
– and look for the "authoritative answer" flag:
snowflake ~ $ dig @a.gtld-servers.net com | grep flags
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
^^