DNS Recon

fierce --domain DOMAIN --dns-servers DCIP --subdomain-file /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt

DNS Zone Transfer

dig @$IP domain.local