DNS is by far my favorite passive way to identify required resources and to perform reconnaissaince against a host.
DNS is one of the least secured protocols and runs as a fairly untrusted
WPAD can be a great resource for identifying hosts home domains without a lot of DNS