Although there are many tools out there that do a great job of enumerating sub-domains, I feel the one that does the best is www.netcraft.com. It is also very good at fingerprinting a web server as well.
Netcraft provides research data and analysis among many of its services. When you enter a website into Netcraft’s search bar, it returns all the sub-domains know for the site, a site report with important network and background information , as well as a basic fingerprint of the hosting provider and web server.
Example Sub-Domain Enumeration:
Example Site Report:
This just scratches the surface of what Netcraft can do to enumerate a web site.