One of the clients we support at work pointed me in this direction, asking if I knew how this was done (getting a list of all domains hosted on a server). The only way I know of is through whois queries, though that only works through networksolutions and it gives back a max of 10 records..
there is also requesting an axfr transfer, but on most servers that doesn't work.
from what the client said, the info on how to do this would be most helpful when doing work on the 500+ servers here.
any info you can give would be most appreciated.