I'm working on a security audit and need to identify DNS aliases—every A record that points to the same IP address as a set of randomly selected computers. Our organization uses Infoblox for DNS, and I only have read-only access to its console. I cannot use the REST API, and we generally do not maintain PTR records for workstations, so reverse lookups are not reliable.
I currently resolve each computer name with PowerShell and can obtain its IP address, but I need to search the forward DNS data for every other A record that references that same address. Using Resolve-DnsName with -Type PTR only works for the few machines that happen to have reverse records, and [Net.Dns]::GetHostEntry() does not provide the aliases I need.
Is there a practical way to perform this search with PowerShell, Infoblox's read-only web console, a zone export, or another DNS utility? I need results suitable for documenting the duplicate records for the auditors, without relying on the REST API or taking screenshots of every search.
4 Answers
If the console already allows you to search for an IP and display related records, that may be enough for the immediate audit. Run the search for each resolved address and save the results in the audit evidence. For a larger set of machines, request a CSV or zone export from the Infoblox administrators instead of trying to reconstruct the database through individual DNS queries.
Infoblox’s management interface may let you export the forward-lookup zone or DNS records to CSV. Export the relevant zone, then filter the address column for each target IP. If you need to find every duplicated address, group the exported A records by IP and inspect groups whose count is greater than one. This is likely the most practical read-only approach when the API is unavailable.
The forward-lookup zone is the source of truth here. A PTR lookup cannot reliably answer this because reverse records may not exist, and a single IP can potentially be associated with multiple forward A records. You need to obtain an export or dump of the forward zone, select the A records, and filter or group them by their IP address. Grouping by the address will show both the duplicate count and the specific host records that share it.
The Microsoft DNS PowerShell cmdlets can do this when the zone is hosted on Microsoft DNS, but they will not directly query an Infoblox database. For Infoblox, use an export from the management console or ask the DNS administrators for the equivalent zone data.
This is not something ordinary DNS resolution is designed to provide. A DNS query normally starts with a name and returns its records; it does not offer a universal reverse index of every name that points to an address. PTR records would provide a reverse mapping only where they have been created, and they generally would not capture all forward records sharing an IP. The DNS administrators should provide an export or perform the search on your behalf.
A complete export is useful even if you initially only need a few addresses. It gives you an auditable data set and makes it easy to search for additional duplicate records later.