Inventory and discovery

Audit every record for a host

Fetch the common record-type set in one request, then probe well-known subdomains to map a domain quickly.

When to use it

Use this when

  • You are onboarding or auditing a domain and want a fast inventory.
  • You want A/AAAA/CNAME/MX/TXT/NS/SOA/CAA without running eight separate lookups.

Steps

Do this

  1. Run All recordsOpen All records, enter the host, and choose a resolver. dnsbin queries the common record types in parallel and groups the answers.
  2. Skim the grouped resultEach record type is its own section; empty types are omitted so the signal stays high.
  3. Probe subdomainsSwitch to Discovery to test a guided core set of common names (www, mail, api, ns1, …) for live records the apex doesn’t reveal. Enable Deep scan to also probe a wider exploratory set (dev, staging, vpn, cpanel, …).

Examples

Copyable commands

REST — all records
curl 'https://dnsbin.ca/api/v1/lookup-all?name=example.com&resolver=cloudflare'
REST — discovery (SSE)
curl -N -H 'Accept: text/event-stream' \
  'https://dnsbin.ca/api/v1/discover?domain=example.com'
REST — deep discovery
curl 'https://dnsbin.ca/api/v1/discover?domain=example.com&deep=1'

Operational notes

Keep in mind

  • Discovery probes a fixed list of common subdomains — it is not a zone transfer (AXFR) and won’t reveal every name.
  • The default core scan stays fast and low-noise; add deep=1 (or tick Deep scan) only when you want the wider exploratory list.
  • Discovery streams progressively over Accept: text/event-stream; lookup-all returns a single JSON response.