>_ shadow.red

dig - DNS Information Groper

Reconnaissance DNS & WHOIS linux

MX records

dig -t mx google.com

All records

dig -t any google.com

Reverse zone transfer (subdomain discovery)

dig ironcorp.me @10.10.69.0 axfr

Specific record types against custom DNS server

dig fire.windcorp.thm @10.10.233.82 -t NS
dig windcorp.thm @10.10.233.82 -t MX
dig fire.windcorp.thm @10.10.233.82 -t TXT
dig any fire.windcorp.thm @10.10.233.82