dig axfr @ns1.example.com example.com
Try zone transfer on each NS dig axfr @ns1.example.com example.com simple dns plus enumeration