DNS Reconnaissance. Run Fierce to make sure all possible targets have been identified. For example, find ftp.domain.
fierce --domain domain