When connecting a computer to most enterprise networks, if the Dynamic Host Configuration Protocol (DHCP) is enabled, it will assign an IP address to that computer, and send a lot of information. Nameservers and domain names are usually set through DHCP offer packets.
On UNIX-like systems, the
/etc/resolv.conffile will store information for name resolution operations after the DHCP offer.
nmap --script broadcast-dhcp-discover