As I said, there is no common way to determine the default, as it depends on the MTA software installed on the local machine, and/or on the configuration of the mail clients sending the mail.
You are right. But sometimes, you may have some luck:
- Querying the DNS for the MX record of the host's domain may work. (But I've seen several LANs where DNS either giving no MX records at all or the wrong ones, unreachable on the other side of the firewalls.)
- The DHCP server's response may include option 69 "SMTP-Server". (Well, I've never seen that.)
- Try to resolve some common host names / aliases (mail, mx, smtp, mailer, post, ...; append 1, 2, 3, 01, 02, 03, -1, -2, -3, -01, -02, -03)
For each candidate, try to connect to the SMTP server on ports 587/tcp (submission) and 25/tcp (smtp).
(Occasionally, I've found LAN mail servers with a brute force nmap scan, scanning for servers with at least one of the two ports open. But don't do that without permission from the network admin, and never in foreign networks!)
Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)