knowledge

Overview

SMTP (Simple Mail Transfer Protocol) is the standard protocol for sending email between servers and from email clients to their outgoing mail server. It operates primarily on TCP/25 (server-to-server) and TCP/587 (client-to-server with authentication). SMTP transmits in cleartext by default; encrypted variants use STARTTLS or TCP/465 (SMTPS). Mail spoofing, open relay abuse, and user enumeration via VRFY/EXPN are the primary attack vectors during penetration tests.

Terminology

TermDefinition
SMTPSimple Mail Transfer Protocol — used to send and relay email
ESMTPExtended SMTP — extension of SMTP supporting AUTH, STARTTLS, and other extensions; triggered by EHLO
MUAMail User Agent — the client software (Outlook, Thunderbird) that composes and sends email
MSAMail Submission Agent — validates and relays email from MUA to MTA; also called Relay Server
MTAMail Transfer Agent — software that routes email between servers; checks for spam/size
MDAMail Delivery Agent — delivers email to the recipient’s mailbox
Open RelaySMTP server misconfigured to forward email from any sender to any recipient
Mail SpoofingForging the sender address in an email — enabled by open relays and weak authentication
STARTTLSCommand to upgrade a plaintext SMTP connection to TLS encryption
SPFSender Policy Framework — DNS TXT record specifying authorized sending IPs for a domain
DKIMDomainKeys Identified Mail — cryptographic email signature to verify sender authenticity
DMARCDomain-based Message Authentication, Reporting and Conformance — policy combining SPF and DKIM

Core Concepts

Mail Flow

Email delivery follows a pipeline of agents:

Client (MUA) → Submission Agent (MSA) → Mail Transfer Agent (MTA) → Mail Delivery Agent (MDA) → Mailbox (POP3 / IMAP)

  1. Client composes email and uploads it to the MTA (with MSA validation)
  2. MTA checks email for size, spam, and stores it temporarily
  3. MTA performs DNS MX record lookup to find the recipient’s mail server IP
  4. Data is relayed to the destination SMTP server
  5. MDA delivers the email to the recipient’s mailbox
  6. Recipient retrieves it via IMAP (server-synced) or POP3 (download and delete)

SMTP Commands

CommandParametersDescription
HELO<hostname>Client identifies itself; starts session (basic SMTP)
EHLO<hostname>Client identifies itself using ESMTP — enables extensions like AUTH and STARTTLS
AUTH PLAIN<base64-credentials>Authenticate using PLAIN mechanism (safe over TLS)
MAIL FROM:<sender@domain>Specify the sender email address
RCPT TO:<recipient@domain> [NOTIFY=success,failure]Specify the recipient; optionally request delivery notification
DATA(body follows, end with . on its own line)Begin email body transmission
RSET—Abort current transmission; keep connection open
VRFY<username>Check if a mailbox exists — used for user enumeration; may return 252 even for nonexistent users
EXPN<alias>Expand a mailing list alias to its members — reveals usernames
NOOP—Keep connection alive; server responds with 250 OK
QUIT—End the session

Example: Send an email manually via telnet/netcat:

EHLO attacker.local
MAIL FROM: <[email protected]>
RCPT TO: <[email protected]> NOTIFY=success,failure
DATA
From: <[email protected]>
To: <[email protected]>
Subject: Test
Date: Mon, 04 Apr 2026 12:00:00 +0000

Test message body.
.
QUIT

Default Configuration

Config file: /etc/postfix/main.cf

Key settings:

SettingDescription
myhostnameFQDN of the mail server
mydomainDomain name of the mail server
myoriginDomain added to unqualified addresses
inet_interfacesNetwork interfaces to listen on
mydestinationDomains this server receives mail for
mynetworksIP ranges authorized to relay through this server
relayhostUpstream relay server
smtpd_bannerBanner shown to connecting clients

Dangerous Settings

SettingRisk
mynetworks = 0.0.0.0/0Open relay — allows anyone to send email through the server
smtpd_recipient_restrictions not setNo relay restrictions; allows spam relay
disable_vrfy_command = noVRFY command enabled — exposes user enumeration
STARTTLS not enforcedCredentials sent in cleartext

Open relay abuse: Attackers route email through a trusted relay server to bypass spam filters. Administrators who misconfigure mynetworks to allow all IPs (both external and internal) create open relays that can be abused in external and internal tests.

Footprinting SMTP

Scan ports 25, 465, and 587 with Nmap (-sV -sC). The smtp-open-relay NSE script runs 16 tests specifically to identify open relay configuration. See Nmap for full script usage.

Connect via proxy: CONNECT <target-ip>:25 HTTP/1.0

User Enumeration

VRFY and EXPN can confirm username existence before brute-forcing other services like SSH.

See smtp-user-enum for the dedicated tool.

Quick manual VRFY: connect with netcat or telnet to port 25 and send VRFY <username> interactively.

ℹ︎Note on Response Code 252

Some SMTP servers respond with 252 Cannot VRFY user even for users that do exist — treating this as “user doesn’t exist” causes false negatives. Use RCPT TO as an alternative verification method.

SecLists username wordlist for SMTP enumeration: /opt/useful/seclists/Usernames/Names/names.txt

The footprinting-specific wordlist referenced in the original HTB module is superseded by SecLists — use SecLists for more comprehensive username lists.

  • Service Enumeration

References / Images