[dns] list entries

[rade]

It would be rather handy - mostly for debugging - to be able to list DNS entries.

AXFR is the way to do that and is supported by a bunch of command line tools, e.g. host -l <domain> and dig <domain> axfr.

The main question we need to answer is to what degree we should control access to this information. Should containers be able to list DNS entries, or just admins? If it's containers, should they be able to list all entries or only entries for domains for which they themselves have an entry?

IMO the answer to the latter is 'all'; containers can already query DNS regardless of whether they themselves have an entry.

There is an obvious information leak here: containers in one app domain can discover the existence of other containers. They can't talk to them, but the names and their existence may constitute sensitive information.

[awh]

Can this be closed now?

[awh]

Closed by #465.