years ago, no one stopped queries for dns xfers, now a days just to aid in the information gathering technique for hacking, most not deny requests for xfers.

My point being, it is more difficult for any single entity to maintain a database of subdomains, since they are really only recorded by the domains name servers of record.

You can get the root domain from net sol but not subdomains. Very difficult these days without the use of xfer via commands such as dig.