Discovery of MOQT servers is always done out-of-band. Namespace discovery can be done in the context of an established MOQT session.
Given sufficient out of band information, it is valid for a subscriber to send a SUBSCRIBE or FETCH message to a publisher (including a relay) without any previous MoQT messages besides SETUP. However, SUBSCRIBE_ANNOUNCES, PUBLISH and ANNOUNCE messages provide an in-band means of discovery of publishers for a namespace.
The syntax of these messages is described in Section 8.