The following are good adds to your DNS brute force list:
These are all SRV records so make sure your type is set correctly. The great thing about SRV records is that it tells you the port in the answer. Isn’t that nice of them?
I don’t know of any DNS tools that utilize SRV as part of their process, but scripting dig to do so isn’t tough.