If the domain uses DNSSEC, you can do an offline brute force: https://security.stackexchange.com/questions/94503/does-dnssec-still-have-the-enumerate-all-names

If the domain uses DNSSEC, you can do an offline brute force: https://security.stackexchange.com/questions/94503/does-dnssec-still-have-the-enumerate-all-names-in-zone-problem https://security.stackexchange.com/questions/94503/does-dnss... https://nmap.org/nsedoc/scripts/dns-nsec3-enum.html https://nmap.org/nsedoc/scripts/dns-nsec3-enum.html There are tools for online brute force, but that's not very polite :)