DNS

Domain Name System, when opened on TCP always check to enumerate host names from this port

DIG

dig axfr domain.tld @10.10.10.10
dig axfr @ns.domain.tld domain.tld