SMTP

SMTP is how mail moves across the internet — and a chatty or misconfigured mail server will confirm valid usernames for you and, at its worst, relay spoofed mail for anyone who asks. VRFY enumeration and open-relay testing are the two things you check every time.

What Is SMTP?

The Simple Mail Transfer Protocol (SMTP) sends email across an IP network. It's usually paired with IMAP or POP3, which handle fetching mail, while SMTP handles sending. Once an email is transmitted the connection closes, and the server forwards it on toward its destination.

By default SMTP is unencrypted — commands, data, and authentication all travel in plain text — so it's typically wrapped in SSL/TLS. To fight spam, modern servers use ESMTP with SMTP-Auth, so only authorized users can send. When people say "SMTP" today, they usually mean ESMTP.

How Mail Flows

The journey of a message touches several agents:

1. The client (MUA — Mail User Agent) splits the email into a header and body and hands it to the SMTP server.
2. The server's MTA (Mail Transfer Agent) checks the mail for size and spam, then stores it.
3. An optional MSA (Mail Submission Agent), also called a relay server, validates the email's origin to relieve the MTA.
4. The MTA looks up the recipient mail server's IP in DNS.
5. At the destination, the packets are reassembled and the MDA (Mail Delivery Agent) drops the message in the recipient's mailbox.

Open relays — servers that forward mail for anyone — are abused to send spam en masse with forged sender addresses (mail spoofing). Defenses like DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework) exist to reject or quarantine suspicious mail.

Default Configuration

A common Linux MTA is Postfix, configured in /etc/postfix/main.cf. SMTP is driven by a small set of commands that tell the server what to do:

Dangerous Settings

To get past spam filters, a sender can route mail through a relay server that recipients trust — a known, verified SMTP server. Normally the sender must authenticate to the relay first.

The problem: administrators often don't know which IP ranges they need to permit, so to avoid breaking mail flow they permit all of them. That's the open-relay misconfiguration you'll find on both external and internal tests.

Open Relay Configuration

# /etc/postfix/main.cf
mynetworks = 0.0.0.0/0

Footprinting the Service

Nmap — Commands and Open-Relay Test

The default smtp-commands script uses EHLO to list everything the server supports:

nmap -p25 --script smtp-commands 10.129.14.128

PORT   STATE SERVICE
25/tcp open  smtp
| smtp-commands: mail.inlanefreight.htb, PIPELINING, SIZE 10240000,
|_VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN

The smtp-open-relay script runs 16 different tests to determine whether the server is an open relay. Add -v to see which tests run:

nmap -p25 --script smtp-open-relay -v 10.129.14.128

| smtp-open-relay: Server is an open relay (16/16 tests)

Telnet — Interact Directly

Use telnet to open a raw TCP session and drive the server by hand. Start with HELO/EHLO:

telnet 10.129.14.128 25

220 mail.inlanefreight.htb ESMTP Postfix (Ubuntu)
EHLO inlanefreight.htb
250-mail.inlanefreight.htb
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250 8BITMIME

Enumerate Users with VRFY

VRFY asks the server whether a user exists. It doesn't always work, but when it does it's a free username oracle:

VRFY root

252 2.0.0 root
VRFY nonexistent
550 5.1.1 <nonexistent>: Recipient address rejected: User unknown

smtp-user-enum — Brute-Force Usernames

When VRFY is enabled, smtp-user-enum will run a wordlist through it:

smtp-user-enum -M VRFY -U users.txt -t 10.129.14.128 -v

If results are flaky, increase the wait time between requests:

smtp-user-enum -M VRFY -U users.txt -t 10.129.14.128 -v -w 15

The -M mode can also be EXPN or RCPT if VRFY is disabled — those verbs sometimes leak users when VRFY doesn't.

Metasploit — Enumerate Users

The Metasploit auxiliary module does the same job and sometimes gets better results:

msfconsole
use auxiliary/scanner/smtp/smtp_enum
set RHOSTS 10.129.14.128
set USER_FILE users.txt
run

[+] 10.129.14.128:25 - Users found: admin, mailadmin, root, sysadmin

Quick Reference

The footprinting flow: nmap for supported commands → open-relay test → telnet in and try VRFY → automate with smtp-user-enum (fall back to EXPN/RCPT if VRFY is off) → confirm with Metasploit.

Next: IMAP / POP3 — reading mailboxes and hunting credentials in mail stores.