How can I determine the domain controller when it's not in DNS?

On a penetration test going in blind for an organization, meaning no knowledge of network topology of design, no idea what the domain(s) might be, and domain controller is not apparent in DNS...how can it be determined what the Domain Controller is?

Assuming a dedicated DNS server instead of the DC handling DNS

Is there any way to determine what the domain controller is in this scenario?