The hint (using axfr) only works if the NS you're querying (ns1.foo.example in your example) is configured to allow AXFR requests from the IP you're using; this is unlikely, unless your IP is configured as a secondary for the domain in question.

Basically, there's no easy way to do it if you're not allowed to use axfr. This is intentional, so the only way around it would be via brute force (i.e. dig a.example.com, dig b.example.com, ...), which I can't recommend, as it could be viewed as a denial of service attack.