[sperwren]

Do you have any references for this functionality? I’ve never encountered something like that in the RFCs, or in any server.

[kaared]

I believe you're referring to DNS zone transfer (https://en.wikipedia.org/wiki/DNS_zone_transfer and https://serverfault.com/questions/890153/how-does-nslookup-l...).

[sperwren]

So presumably nslookup -ls had some logic for finding the apex for a particular name, doing an AXFR and then filtering it to the the target name and below?

[jbverschoor]

Yeah, I think it was for zone transfers. It was pretty fun discovering 'private' hosts :-)