Public DNS records of a Lab domain: addresses (A), mail servers (MX), verification texts (TXT), aliases (CNAME) and known subdomains.

In real life: dig, nslookup, DNSDumpster, SecurityTrails. Verification TXT records and CNAMEs often give away the services a company uses.