How can I find all sub-domains using PowerShell?

Question

I can use Resolve-Dns to retrieve an A record (if one exists) for a given domain name. Is there a way, using PowerShell, to find all sub-domains?

Here's a specific use case:

One of Microsoft's stated domains to allow through firewalls is: *.blob.core.windows.net. I have not found a way to resolve an IP address for this using PowerShell. For windows.net Resolve-Dns resolves several A records but this *.blob... address actually has 1600 related sub-domains. (Source: https://spyse.com/)

I want to use PowerShell to resolve all of those 1600 sub-domains. Is this possible?

Answer 1

Without being able to accomplish a DNS zone transfer I doubt you'll find an easy way to do this. There are "subdomain finders" available, but they mostly written in Python. Rewriting one of them using PowerShell and .Net might be something to explore.

Here's a starting point, though:
find-subdomains