IP segment to obtain DNS server
nmap 192.168.190.0/24 -p53
Reverse analysis to obtain the host domain name
host 192.168.137.149 192.168.137.149
Find subdomain records
dig @192.168.137.149 -t axfr MAILMAN.com
View subdomain records
dig @192.168.137.149 -t axfr _msdcs.MAILMAN.com