It's been my understanding in the past years that it's not easily possible to find out all the subdomains of a domain (unless these are used publicly, like in hyperlinks, etc), and likewise not easily possible to find all domains/submains that are associated to a specific IP.
However, if I lookup any of my IP addresses or Domains in https://securitytrails.com/, it seems to know:
ALL subdomains for all my domains, whether they're used publicly or privately (e.g. between colleagues)
ALL domains and subdomains I use on my own home network/IP, that I never shared to public (but use on my own devices)
My DNS is managed mostly by AWS Route53 and Namecheap DNS.
I'd like to understand if my impression has been wrong. I understand how the public domains are known, and PTR/rDNS records can be used to find some, but I can't understand how the privately used subdomains can be found.
Is there anything that can be done, or that I can look into, that at least gives some "privacy" in relation to DNS?
I'm not looking for "security by obscurity", but whatever I can do to help hiding what's not supposed to be public, that would always be welcome.