Optaining list of site on Name server

apparently, there exists a couple of websites on the Internet that are able to list all the domains registered in a namerserver.

For example:

• http://www.gwebtools.com/ns-spy/udns1.ultradns.net

Or all domains pointing to a specific IP :

• http://www.robtex.com/ip/190.7.200.92.html

(These DNS/IP were picked at random)

There are two ways that a domain name => DNS server map can be constructed:

1. Zone file access: some registries grant access to their zone files to their registrars and other entities. This makes it pretty easy to determine which domains in those zones are delegated to a given DNS server. This is how DomainTools.com provides their Name Server Spy product. This is the most reliable method, but is obviously limited to the zone files that they have access to.
2. Passive DNS. This involves examining traffic through recursive DNS servers at ISPs and reconstructing zone data based on what’s seen. This method lets you discover information from the entire DNS space, but is less reliable as changes take longer to appear in your database, and won’t recover information about domains that get little or no queries.