DNS

for ip in $(seq 0 255); do host -a 192.168.219.$ip 192.168.219.149; done | grep -v 'NXDOMAIN|Received|Trying|Using|Name|Address|Aliases'

dig axfr @192.168.219.149 _msdcs.mailman.com

dnsenum

dnsrecon