dnsenum --dnsserver $IP $DOMAIN

Enumerate DNS records, attempt zone transfers, and brute force subdomains for a domain

Command: Linux

References:

https://www.kali.org/tools/dnsenum/