dnsenum

DNS recon: A / NS / MX, AXFR, brute-force subdomains.

$ dnsenum --enum target.example
$ dnsenum -f /usr/share/dnsenum/dns.txt target.example