nmap allows the use of different DNS servers (not local). What is the benefit of doing so?
There are all sorts of reasons:
- You might not have access to local DNS servers.
- You might want to query against a specific non-default DNS server within the organisation, which you suspect may leak more information than their defaults.
- You might not want to alert a sysadmin / blue team by performing lots of DNS lookups across the infrastructure, so you might opt for an alternative DNS.
- You might not want to use your ISP's DNS servers (or other 3rd party DNS) for legal or contractual reasons.
I'm sure there are other reasons too. These are just a few off the top of my head.