How can I find any domain name that resolves to IP within a given net range?

"Well, the DiG utility (man dig) can do reverse-DNS lookups to see if a given IP address has an associated DNS record. AFAIK it only accepts a single address at a time, but you could use some bash looping to generate the commands to check all the addresses.

for i in $(seq 128 191) ; do
for j in $(seq 1 255) ; do
for k in $(seq 1 255) ; do
dig -x 172.$i.$j.$k
sleep 5
done
done
done

In one line:

for i in $(seq 128 191) ; do for j in $(seq 1 255) ; do for k in $(seq 1 255) ; do dig -x 172.$i.$j.$k ; sleep 5 ; done ; done ; done

You might want the +short option (or other options) to help get the output into some meaningful form. See man dig for possible options; here's the syntax:

dig +short -x 172.$i.$j.$k"