Is there any way I can list ALL DNS records for a domain?
I know about such things as dig and nslookup but they only go so far. For example, if I've got a subdomain A record as
test A somedomain.co.uk
then unless I specifically ask for it, eg.
dig any test.somedomain.co.uk
I can't see it.
Is there any way (other than looking at the records by going to the DNS manager) to see exactly what all the DNS records are?
The short answer is that it's usually not possible, unless you control the domain.
When you query for ANY, you will get a list of all records at that level but not below.
# try this
dig google.com any
This may return A records, TXT records, NS records, MX records, etc if the domain name is exactly "google.com". However, it will not return child records (e.g., www.google.com). More precisely, you MAY get these records if they exist.
The name server does not have to return these records if it chooses not to do so (for example, to reduce the size of the response). Most DNS servers reject ANY queries.
An AXFR is a zone transfer, and is likely what you want. However, these are typically restricted and not available unless you control the zone. You'll usually conduct a zone transfer directly from the authoritative server (the @ns1.google.com below) and often from a name server that may not be published (a stealth name server).
# This will return "Transfer failed"
dig @ns1.google.com google.com axfr
If you have control of the zone, you can set it up to get transfers that are protected with a TSIG key. This is a shared secret the client can send to the server to authorize the transfer.
Another option is to scrape all DNS records with a script. You'd have to iterate through all the DNS record types, and also through common subdomains, depending on your needs.
There are some online tools that enumerate subdomains, and online tools that list all DNS records for a DNS name. Note that subdomain enumeration is usually not exhaustive.