[tephra]

There are a variety of ways!

Some TLDs gives you open access to just query the DNS and do an AXFR (download the whole zone), for example the .se and .nu ccTLDs (which I happen to work for the foundation managing those): dig @zonedata.iis.se se AXFR > se.zone.txt

For some zones you could use NSEC traversal https://linux.die.net/man/1/walker

For the new gTLDs (.app, .dev, .xyz, etc, etc) there is the Centralized Zone Data Service provided by icann: https://czds.icann.org/home where you can request access to zones.

[TZubiri]

So there's the possibility of some .gov TLDs being missed, like secret CIA stuff. Or the guy that commented on here that he uses a custom .gov for his home servers.

[BenjiWiebe]

The custom .gov for his home servers doesn't exist except in his home network. You can put absolutely any domain in your home network that you want.

[TZubiri]

And the TLD .gov doesn't exist except on the internet. Similarly if there's a .gov in some CIA intranet, does it exist or not exist? That's a metaphysical question

[chirau]

I would want to do .gov.zw

How would I know if they have open access?