A tool like WHOIS from any provider can provide you with the DNS servers for a specific domain (NS records). Once you know the name servers, you can query these directly. If the DNS servers allow for a zone transfer, you'll be able to obtain all the records for the DNS zone.
In Windows, you could use:
nslookup
server x.x.x.x (where x.x.x.x matches one of the zones NS records)
set type=any
ls -d company.net
exit
If the zone does not allow for zone transfers, you could use a tool to enumerate DNS records like with FierceDNS (perl script):
http://carnal0wnage.blogspot.com/2007/12/fiercedns-for-dns-enumeration.htmlHope this helps...
Mike