AD-DS (Active Directory Domain Services) rely on DNS SRV RR (service location resource records). Those records can be queried to find the location of some servers: the global catalog, LDAP servers, the Kerberos KDC and so on.
nslookup is a DNS client that can be used to query SRV records. It usually comes with the dnsutils package.
In order to function properly, the tools need to know the domain name and which nameservers to query. That information is usually sent through DHCP offers and stored in the /etc/resolv.conf or /run/systemd/resolve/resolv.conf file in UNIX-like systems.
If needed, the nameservers may be found with a port scan on the network by looking for DNS ports 53/TCP and 53/UDP.
nmap -v -sV -p 53$SUBNET/$MASK
nmap -v -sV -sU -p 53$SUBNET/$MASK
The DNS service is usually offered by the domain controllers
Active Directory SRV Records | Petri IT Knowledgebase
Petri IT Knowledgebase
In Active Directory Integrated DNS, reverse lookup zones are used to resolve IP addresses to hostnames. This operation relies on DNS PTR records. This allows to find the names of the hosts in a network. The presence of reverse lookup zones is not mandatory in Active Directory, hence limiting reverse lookup capabilities.