> apparently, "asking DNS servers for all the domains they know about" is not something you can really do anymore for security reasons. Guess that idea won't fly lol

There are actually a few nameservers that will just give all their domains to anyone who asks [0], but they are very much in the minority.

[0]: https://github.com/acidvegas/mdaxfr#tlds-that-allow-axfr