You want to find the PDC Emulator for a domain using DNS.
> nslookup -type=SRV _ldap._tcp.pdc._msdcs.<
The PDC Emulator FSMO role is the only FSMO role that is stored in
DNS. Like many of the other Active Directory-related DNS records, the
PDC record is stored as an SRV record under _ldap._tcp.pdc._msdcs.
<DomainDNSName> is the domain
the PDC is in.
Recipe 3.21 for finding domain controllers via DNS