I had to edit my original question after several answers were submitted. Original question was: how one can find out sub-domains of a domain without brute-force? is there a way to request a domain hosting provider or a name server for sub-domains? as far as I know one can only access a sub-domain if the name is known but if the sub-domain is not known then there is no other way to find it unless you do a brute-force, am I correct?
Edited: The domain or sub-domains I am referring to do not have any robots.txt or TXT records or PTR The they all are hosted with very good hosting provider like Godaddy and other such like providers. So, there is no issue of insecure DNS! Also, the sub-domains have not been shared with any one or used anywhere in internet, these were created only for a test, plus on top of it these sub-domains, the technician and the VPS that these subdomains were pointing too were in the same country.
My understanding was that if a sub-domain is known only with your hosting provider and you and it is not shared with any one there would be no way to find that sub-domain, except brut force.
Reason I am asking this question, I came across to this site “securitytrails.com” that had my sub-domains I was suppressed
For a test I have created a sub-domain “aonfactuurportz.[myDomain]” and after some time it appeared in there.