dnsrecon

dnsrecon -d <domain> -a

DNS enumeration to discover A, MX, NS, SRV records and potential zone transfers.

During internal reconnaissance phase, to map the DNS infrastructure of the domain: servers, services, and subdomains. dnsrecon can help find AD SRV records (LDAP, Kerberos) and other services.

If you don't have access to internal DNS servers or if the firewall blocks DNS queries. Also if the internal DNS is restricted.