I am trying to figure out a way of counting / listing all sub domains of a given domain.

For example if I have usa.gov I would like to list all the vaild subdomains
for it like xxx.usa.gov , mmm.usa.gov , xxx.xxx.usa.gov ,...etc

Is their a command or tool out their that lets you do this.
Perhaps a website that could do this for you.

 

I think only way is if the dns can do a zone transform to you.
Which is probably not the case in most domain name servers unless you are a secondary dns server...etc

Is their any way to find out the range of ip address's or a list of all ip address associated to a specific domain? Because if their is then doing a reverse dns lookup on all of them will accomplish the same thing.

Anybody know?