Discovery of MOQT servers is always done out-of-band. Namespace discovery can be done in the context of an established MOQT session.
Given sufficient out of band information, it is valid for a subscriber to send a SUBSCRIBE or FETCH message to a publisher (including a relay) without any previous MOQT messages besides SETUP. However, SUBSCRIBE_NAMESPACE, SUBSCRIBE_TRACKS, PUBLISH and PUBLISH_NAMESPACE messages provide an in-band means of discovery of publishers for a namespace.
The syntax of these messages is described in Section 10.