# SMTP

> Mail transfer service for sending emails.

- **URL:** https://hackindex.io/services/smtp
- **Type:** Service
- **Default ports:** 25, 465, 587
- **Tags:** smtp, email, network, linux, reconnaissance, enumeration
- **Published:** 2025-12-31
- **Updated:** 2026-07-13

SMTP (Simple Mail Transfer Protocol) handles email delivery and runs on **TCP port 25** (relay), **TCP port 465** (SMTPS, implicit TLS), and **TCP port 587** (submission with STARTTLS). Nmap identifies it as `smtp`. Common servers include Postfix, Exim, Sendmail, and Microsoft Exchange.

SMTP servers can leak valid usernames through the `VRFY` and `EXPN` commands or by observing `RCPT TO` responses. Open relays allow sending spoofed emails, which is useful for phishing. Misconfigured servers may accept mail without authentication.

Enumerate the server version from the banner, then test for user enumeration with `smtp-user-enum`. Check if the server is an open relay. If credentials are available, test authenticated access on the submission port.

## Phases

- [Enumeration](https://hackindex.io/services/smtp/enumeration.md): Enumerate SMTP banners, auth methods, and NTLM info via nmap and openssl (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/smtp/vulnerability-discovery.md): Guides on testing SMTP for open relays and user enumeration (2 guides)
- [Exploitation](https://hackindex.io/services/smtp/exploitation.md): Guides on relay abuse, spoofed email delivery, and auth brute force (2 guides)