Academy - Footprinting - DNS

Just follow the steps in the lesson.

Try zone transfer for each sub-domains you see
For the zone you cannot zone transfer, use the dnsenum command shown in the lesson. (Just use the right wordlist from seclist.).