If the DNS bruteforce returns ns#@domain.com style results, test them for zone transfers and record results if successful.