fierce

DNS reconnaissance / subdomain discovery (authorized only).

$ fierce --domain example.com
$ fierce --domain example.com --subdomain-file subs.txt
$ fierce --domain example.com --dns-servers 1.1.1.1