For a research project I’m working on, it has become necessary to scan potentially large IPv4 prefixes in order to find any DNS revolvers that I can and classify them as either open (accepting queries from anyone) or closed.
Disclaimer: This is a form of port scanning and thus has associated ethical and legal considerations. Use it at your own risk.
This project is available on GitHub: jpverkamp/dnsscan