Domain Name System — zone transfers, subdomain brute, and reverse lookups.
dig axfr @$t domain.comdnsrecon -d domain.com -t axfrhost -l domain.com $tdnsenum domain.comgobuster dns -d domain.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt