DNS Enum
From Pessin randon wiki

Description
You have been recruited to conduct audit on company DNS server. You must find out if any internal DNS records are exposed to the public.
80 pts
Question
Conducting DNS enumeration activities to see if you can find anything interesting.
Domain to enumerate is dns.ctf
P.S. When you find the flag, it's obvious :)
Solution
I performed DNS enumeration as requested: dnsrecon -d dns.ctf
The flag was there.
Flag
ctftech{ad4a4091-48ea}