Scan a domain, performing DNS cache snooping

dnsrecon

dnsrecon --domain {{example.com}} --type snoop --name_server {{nameserver.example.com}} --dictionary {{path/to/dictionary.txt}}

click the source code to copy install dnsrecon on any operating system with command-not-found.com