DIG

root@oco:~$ nslookup -query=ns {zonetransfer.me}
 * this identifies the ns responsible for the domain zonetransfer.me
    - zonetransfer.me is a service specifically setup to demonstrate the 
      risks of zone transfers
 * ALT: dig ns zonetransfer.me @10.129.146.20

root@oco:~$ dig axfr nsztm1.digi.ninja zonetransfer.me
 * ALT: dig axfr @10.129.146.20 {targetFQDN}
    - the 10.129.146.20 is the dns server of the target domain