[kaared]

I believe you're referring to DNS zone transfer (https://en.wikipedia.org/wiki/DNS_zone_transfer and https://serverfault.com/questions/890153/how-does-nslookup-l...).

[sperwren]

So presumably nslookup -ls had some logic for finding the apex for a particular name, doing an AXFR and then filtering it to the the target name and below?