If all SQL Servers use Domain Service accounts with proper Service Principal Names configured, you could query Active Directory. If you have a default port for SQL Server and know all the IP Ranges / Subnets, you could do a port scan if you're allowed to.