Given an email address, for example EMail@HideDomain.com, you can perform a DNS lookup to retrieve the MX record for the domain 'somewhere.com'. The DNS response will return the IP addresses of one or more SMTP mail servers that will accept mail for the domain.
Applications like Outlook do not perform DNS MX lookups. They expect to be configured with a known SMTP server address to which it will direct all email - for example an SMTP server address supplied by an ISP. The SMTP server will itself perform DNS MX lookups for all destination email domains it does not recognise and forward emails to the respective servers.
In short, you do not need to know any SMTP servers if you are prepared to write the DNS MX lookup code. The DNS protocol and packet format is widely documented on the web. Basically you construct and transmit UDP packets to a DNS server and decode the response from it.