Some TLDs gives you open access to just query the DNS and do an AXFR (download the whole zone), for example the .se and .nu ccTLDs (which I happen to work for the foundation managing those): dig @zonedata.iis.se se AXFR > se.zone.txt
For the new gTLDs (.app, .dev, .xyz, etc, etc) there is the Centralized Zone Data Service provided by icann: https://czds.icann.org/home where you can request access to zones.
Some TLDs gives you open access to just query the DNS and do an AXFR (download the whole zone), for example the .se and .nu ccTLDs (which I happen to work for the foundation managing those): dig @zonedata.iis.se se AXFR > se.zone.txt
For some zones you could use NSEC traversal https://linux.die.net/man/1/walker
For the new gTLDs (.app, .dev, .xyz, etc, etc) there is the Centralized Zone Data Service provided by icann: https://czds.icann.org/home where you can request access to zones.