Don't 'A' records only return IPv4 addresses?
Why do some websites return subdomains? How do they find those subdomains? I mean, are they doing normal subdomain bruteforcing then resolve each subdomain's A record?
Examples of those websites: DNSDumpster.com => Under 'A' Host Records section
and this one as well https://hackertarget.com/find-dns-host-records/
For example, when looking for uber.com, it returns the following list of subdomains: Example
Does that mean that it tries to match whatever entries having the string uber.com ocurence and returns its corresponding IPv4 address in the DNS server?