dnsrecon

#find dns pointer records of remote server

-n is remote server

-d domain, required and anything thing entry is ok

dnsrecon -r 127.0.0.0/24 -n 10.0.0.1 -d fqdn