When troubleshooting network configurations or performing server migrations, administrators often need to identify all DNS aliases (CNAME records) pointing to a particular server. The standard nslookup command shows limited information by default, only resolving the primary hostname or IP address.

Windows provides several built-in tools for DNS queries:

# Basic forward lookup (limited to A records)
nslookup server01.yourdomain.com

# Reverse lookup (PTR records)
nslookup 192.168.1.100

# Enhanced query with record type specification
nslookup -querytype=CNAME server01.yourdomain.com

The -querytype=CNAME parameter is particularly useful, but requires prior knowledge of potential aliases.

For more comprehensive results, PowerShell's Resolve-DnsName cmdlet offers better flexibility:

# Get all DNS records for a host
Resolve-DnsName server01.yourdomain.com -Type ALL

# Specifically query CNAME records
Resolve-DnsName -Name server01.yourdomain.com -Type CNAME

# Find all CNAME records pointing to this server's IP
$ip = (Resolve-DnsName server01.yourdomain.com).IPAddress
Resolve-DnsName -Type PTR $ip | ForEach-Object {
    Resolve-DnsName $_.NameHost -Type CNAME
}

If you have permissions, examining the DNS zone directly provides the most complete information:

# List all records in the zone (requires permissions)
nslookup -type=any yourdomain.com

# For internal Microsoft DNS servers
dnscmd /enumrecords yourdomain.com @

For Active Directory environments without admin access:

• RSAT (Remote Server Administration Tools) - Lightweight version
• AD Explorer (Sysinternals) - Read-only AD browser
• PowerShell Active Directory module (import with Import-Module ActiveDirectory)

Here's a complete PowerShell script to find all aliases for a server:

$server = "server01"
$domain = "yourdomain.com"

# Get primary IP
$ip = (Resolve-DnsName "$server.$domain").IPAddress

# Find all PTR records for the IP
$ptrRecords = Resolve-DnsName -Type PTR $ip

# Check each PTR for CNAMEs
$aliases = $ptrRecords | ForEach-Object {
    $hostName = $_.NameHost
    $cname = Resolve-DnsName -Name $hostName -Type CNAME -ErrorAction SilentlyContinue
    if ($cname) {
        $cname.Name
    } else {
        $hostName
    }
}

$aliases | Sort-Object -Unique

When troubleshooting network configurations or documenting infrastructure, administrators often need to identify all DNS aliases (CNAME records) pointing to a particular server. The standard nslookup command provides basic functionality but doesn't directly reveal all associated aliases.

Method 1: Using nslookup with Advanced Parameters

While basic nslookup commands only show A records, we can query DNS more thoroughly:

nslookup -querytype=CNAME example.com
nslookup -querytype=ANY server.domain.local

Method 2: PowerShell Alternative

For modern Windows systems, PowerShell provides more robust DNS query capabilities:

Resolve-DnsName -Name "server01" -Type CNAME -Server your.dns.server
# To find all records pointing to a specific IP:
Resolve-DnsName -Type PTR -IPAddress "192.168.1.100"

1. RSAT Tools (Remote Server Administration Tools)

While requiring installation, these Microsoft-provided tools offer comprehensive AD/DNS management:

# After installing RSAT:
Get-ADObject -Filter 'ObjectClass -eq "computer"' -Properties *
# Or for DNS-specific queries:
Get-DnsServerResourceRecord -ZoneName "domain.local" -RRType "CNAME"

2. Third-Party Utilities

Portable tools like DNSDataView from NirSoft can export all DNS records without installation:

# Sample command-line usage:
DNSDataView.exe /scomma output.csv /HostFilter "server*"

Here's how I typically approach this task when documenting a network:

1. First identify the server's primary FQDN
2. Query both forward (name→IP) and reverse (IP→name) records
3. Check for related service records (SRV, MX, etc.)

# Comprehensive query example:
$ip = (Resolve-DnsName -Name "mailserver01").IPAddress
Resolve-DnsName -Name $ip -Type PTR | Select-Object -ExpandProperty NameHost

• Results depend on DNS server configuration and permissions
• Some organizations split DNS zones between internal/external
• Cached records may show outdated information

For regular network documentation, consider automating these queries with PowerShell scripts that output to CSV files. Create scheduled tasks to run them periodically and maintain up-to-date server alias records.