right now we're getting .au domains from Open Crawl. It's tricky because the zone file is not available like you mentioned. If anyone has any ideas on how to get more .au domains, we'll gladly implement.
DNS queries, if you have access to recursive resolvers.
We have a great recursive resolver source but haven't been able to integrate it into the data pipeline yet.
thanks for the note and ideas!