Find all subdomains of a domain

To find out subdomains of a domain, first do:

dig domain_name.com

to find the name servers in the authority section (we'll call them ns1.foo.bar and ns2.foo.bar)

then do a:

dig @ns1.foo.bar domain_name.com axfr

or

dig @ns2.foo.bar domain_name.com axfr