Wow. I did not know you could use Wolfram Alpha to list subdomains of a domain name, even if they don't support AXFR. Almost like host -l in the good old days.