Can all Sub-Domains of a Domain in the Name Server be publicly listed or not?

Question

Hello,

When querying a full URL (with Subdomain and Domain) my browser will first "query" for the Name-Server of the Domain. The Name-Server of the Domain has the "NS Entry", that points to the "final (in most cases)" Name-Server where it can try to resolve the Subdomain...

Is my assumption correct, that there is no possibility to query (retrieving a list) of all Subdomains of a Domain? (Assuming that Zone-File Transfers are NOT allowed by the target Name-Server).

My question is, if it is possible to give out long and cryptic Subdomains to users that then are "private" to these users (unless they disclose the Subdomain name to others and ignoring any potential "sniffing" attacks on the network layers...)

Thank you very much, jan

Answer 1

No, there is no way (if zone transfer is disabled, which is the most common case) to retrieve the list of subdomains.

Using them as passwords is still a bad idea: URLs tend to leak (Google Chrome calls home, Alexa, etc).