I've seen there are programs for pentesting, such as FOCA, that provide tools for DNS snooping. The part I don't understand is how can we know the DNS server an organization is using.
Also, from what I understand, if
xyz.example uses xyz.dns server, it means that that site asks that DNS server for the IP's of the domain names it's trying to get to. However,
xyz.example it's a website so I don't understand how can that provide info about what sites are visiting the members of that organization. I think it's not that straightforward and what you're doing is guessing that if the organization website is using a particular DNS server, then the other servers, PC's, etc. are probably using the same DNS server, but I'd like someone to explain this in more detail.