Comment by slow_typist

Like municipalities, companies have domains. So in short, yes, if you have a list of domains of the population you are interested in. The DNS tells which server handles incoming email, that is public information. The detection part (who is the provider, what kind of system do they use) can be trickier. You have probably noted the confidence levels given if you click on a certain municipal body. It could be fingerprinting, standard tool to do this would be nmap, or interpretation of the DNS responses, or a combination, or something else (like sending emails and hoping for a response that tells something about the system it went through).