Comment by teddyh

That is false. If all you want is all subdomains and IP addresses, you can query each enumerated name for A records; you get any NS records (or CNAME records) on that name for free in the answer, and can follow those. ANY queries are not needed, and their removal does not help you in the slightest.

Is that your only argument?