Shameless self-plug: You can use Fierce! A DNS reconnaissance tool - https://github.com/mschwager/fierce