There's more...

The DNS Record Scanner and Enumerator auxiliary module can also be used for active information gathering, using its brute forcing capabilities. By setting ENUM_BRT to true, it will brute force subdomains and hostnames via the supplied wordlist, which you can customize by setting the WORDLIST option to the path of your wordlist.