Skip to main content

​
SMTP

SMTP is how mail moves across the internet — and a chatty or misconfigured mail server will confirm valid usernames for you and, at its worst, relay spoofed mail for anyone who asks. VRFY enumeration and open-relay testing are the two things you check every time.
Protocol: TCP · Port: 25 (and 587 for submission, 465 for SMTPS)

​
What Is SMTP?

The Simple Mail Transfer Protocol (SMTP) sends email across an IP network. It’s usually paired with IMAP or POP3, which handle fetching mail, while SMTP handles sending. Once an email is transmitted the connection closes, and the server forwards it on toward its destination. By default SMTP is unencrypted — commands, data, and authentication all travel in plain text — so it’s typically wrapped in SSL/TLS. To fight spam, modern servers use ESMTP with SMTP-Auth, so only authorized users can send. When people say “SMTP” today, they usually mean ESMTP.

​
How Mail Flows

The journey of a message touches several agents:
  1. The client (MUA — Mail User Agent) splits the email into a header and body and hands it to the SMTP server.
  2. The server’s MTA (Mail Transfer Agent) checks the mail for size and spam, then stores it.
  3. An optional MSA (Mail Submission Agent), also called a relay server, validates the email’s origin to relieve the MTA.
  4. The MTA looks up the recipient mail server’s IP in DNS.
  5. At the destination, the packets are reassembled and the MDA (Mail Delivery Agent) drops the message in the recipient’s mailbox.
Open relays — servers that forward mail for anyone — are abused to send spam en masse with forged sender addresses (mail spoofing). Defenses like DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework) exist to reject or quarantine suspicious mail.

​
Default Configuration

A common Linux MTA is Postfix, configured in /etc/postfix/main.cf. SMTP is driven by a small set of commands that tell the server what to do:

​
Dangerous Settings

To get past spam filters, a sender can route mail through a relay server that recipients trust — a known, verified SMTP server. Normally the sender must authenticate to the relay first. The problem: administrators often don’t know which IP ranges they need to permit, so to avoid breaking mail flow they permit all of them. That’s the open-relay misconfiguration you’ll find on both external and internal tests.

​
Open Relay Configuration

mynetworks = 0.0.0.0/0 turns the server into an open relay — it’ll send mail on behalf of anyone, from any address. That enables mass spam, but for a pentester the real value is spoofing: sending convincing internal email (phishing) and, in some setups, intercepting or reading mail.

​
Footprinting the Service

​
Nmap — Commands and Open-Relay Test

The default smtp-commands script uses EHLO to list everything the server supports:
The smtp-open-relay script runs 16 different tests to determine whether the server is an open relay. Add -v to see which tests run:

​
Telnet — Interact Directly

Use telnet to open a raw TCP session and drive the server by hand. Start with HELO/EHLO:

​
Enumerate Users with VRFY

VRFY asks the server whether a user exists. It doesn’t always work, but when it does it’s a free username oracle:
Depending on configuration, some servers return code 252 for every address — confirming users that don’t actually exist. Treat 252-for-everything as “VRFY enumeration is unreliable here.” A full list of SMTP response codes is at serversmtp.com.

​
smtp-user-enum — Brute-Force Usernames

When VRFY is enabled, smtp-user-enum will run a wordlist through it:
If results are flaky, increase the wait time between requests:
The -M mode can also be EXPN or RCPT if VRFY is disabled — those verbs sometimes leak users when VRFY doesn’t.

​
Metasploit — Enumerate Users

The Metasploit auxiliary module does the same job and sometimes gets better results:

​
Quick Reference

The footprinting flow: nmap for supported commands → open-relay test → telnet in and try VRFY → automate with smtp-user-enum (fall back to EXPN/RCPT if VRFY is off) → confirm with Metasploit.
Next: IMAP / POP3 — reading mailboxes and hunting credentials in mail stores.