dnsrecon

DNS reconnaissance: standard, AXFR, brute, reverse, cache snooping.

$ dnsrecon -d target.example
$ dnsrecon -d target.example -t axfr
$ dnsrecon -r 10.0.0.0/24