Or you could use some of the packages like dnsquery or dlint or dnstree which suck the whole zone. You'll then have data on every server that they have named. You will be able to get a similar effect by running these programs on any of their private nameservers.

I'm not going to give you links. If you can't find them, you shouldn't be using them (the packages and the DNS servers).

____________________
Jeremy
I didn't believe in evil until I dated it.