- Zone Transfer
	- `dig @<server IP> ironcorp.me axfr`
	- `nslookup ls -d <domain name>`
- Extract all DNS records via LDAP (requires domain user)
	- `adidnsdump -u contoso\\Anakin contoso.local`
- DNSRecon
	- `dnsrecon -d TARGET -D /usr/share/wordlists/dnsmap.txt -t std --xml ouput.xml`
- Internal Network
	- `nmap --script broadcast-dhcp-discover`
		- Uses DHCP Discover requests to enumerate the current domain
	- Get a list of domain controllers (replace domain.local with domain name)
		- `dig -t SRV _gc._tcp.domain.local`
		- `dig -t SRV _ldap._tcp.domain.local`
		- `dig -t SRV _kerberos._tcp.domain.local`
		- `dig -t SRV _kpasswd._tcp.domain.local`