You can do a DNS zone transfer using dig by using axfr
dig axfr @dns-server.com target.tld
This will return all dns records for target.tld. It’s intended to copy all records from a primary to secondary server and should only happen if trusted, but misconfigured servers may allow unauthorised transfers allowing for enumeration without brute forcing 🌿
.