i see you're missing various AWS .txt's. I thought I'd go and grab em and contribute this at least. i've deviated from your suggested process a little, instead of looking at just the one /24 for each nameserver, i've just seen 'aws' and gone and got all the IP ranges for AWS (using asnip which might get the info from all sorts of places but whatever it does it does so reliably and comprehensively and i've never felt the need to investigate further). big as these people are you're still talking about minutes of scan time...
root@h04s10:~/nomad/contrib/xmap/examples/udp-probes# wc -l ~/aws_dns_53_*
4638118 /root/aws_dns_53_tcp
63408 /root/aws_dns_53_udp
4701526 total
obviously the tcp responses are mostly lies (syn scan only), udp we know we have a dns server at least - it reinforces the need to validate such things. i will write something now to wallop through lists of potential DNS servers and identify a) authoritative b) recursive c) selfish/fraudulent ones for a given domain.
its a little shy of your approach (which is far more precise and less labour intensive at the user end of things) but if i make a pull request with (probably) a go application to do the above (take resolvers and identify useful ones for enumeration like you're doing) would you have any interest in including it?
if not i'll probably start doing this and end up doing something entirely different. your call... i guess.
simple shit like this is the most useful... in fact if we dont do this i will finally make a version of vhost-sieve to work rapido.... another superb underrated (imo) essential part of ANY pen test.