DNS

COMMAND

##NS request to the specific nameserver.
dig ns <domain.tld> @<nameserver>

##ANY request to the specific nameserver.
dig any <domain.tld> @<nameserver>

##AXFR request to the specific nameserver.
dig axfr <domain.tld> @<nameserver>

##Subdomain brute forcing.
dnsenum --dnsserver <nameserver> --enum -p 0 -s 0 -o found_subdomains.txt -f ~/subdomains.list <domain.tld>