# SMTP enumeration

> Techniques for enumerating valid users and gathering SMTP server info using VRFY, EXPN, and RCPT TO commands during reconnaissance.

- **URL:** https://hackindex.io/services/smtp/enumeration/smtp-enumeration
- **Path:** SMTP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/smtp/enumeration.md)
- **Published:** 2026-01-18
- **Updated:** 2026-08-11

SMTP enumeration extracts server version, supported capabilities, authentication mechanisms, and internal hostnames from the banner and EHLO response. The three ports behave differently: port 25 is server-to-server and often leaks more, port 587 is submission and usually enforces AUTH and STARTTLS, port 465 uses implicit TLS. Always check all three and compare output: misconfigurations are often port-specific.

- Service Discovery
- Banner Grab and EHLO
- NSE Script Enumeration
- STARTTLS and TLS Certificate
- NTLM Info Extraction
- User Enumeration: VRFY and EXPN
- User Enumeration: RCPT TO
- Automated User Enumeration

## Service Discovery

```bash
nmap -sV -p 25,465,587 $TARGET_IP
# 25/tcp  open  smtp     Postfix smtpd
# 465/tcp open  ssl/smtp Postfix smtpd
# 587/tcp open  smtp     Postfix smtpd
```

## Banner Grab and EHLO

Connect to port 25 and send EHLO to get the full capability list. The banner hostname often leaks internal naming useful for AD recon:

```bash
nc -nv $TARGET_IP 25
# 220 mail.internal.company.com ESMTP Postfix (Ubuntu)
```

```bash
echo -e 'EHLO test\nQUIT' | nc -nv $TARGET_IP 25
# 220 mail.internal.company.com ESMTP Postfix
# 250-mail.internal.company.com
# 250-PIPELINING
# 250-SIZE 10240000
# 250-VRFY
# 250-ETRN
# 250-STARTTLS
# 250-AUTH PLAIN LOGIN
# 250-8BITMIME
# 250 DSN
```

Note which capabilities are advertised: `250-STARTTLS` means TLS is available but not required. `250-AUTH` shows which authentication mechanisms are supported. `250-VRFY` means user validation is enabled. Missing STARTTLS on port 587 is a misconfiguration: credentials sent there are plaintext on the wire.

## NSE Script Enumeration

Run the SMTP NSE scripts for structured capability output and relay testing in one pass:

```bash
nmap -p 25,465,587 --script smtp-commands,smtp-ntlm-info,smtp-open-relay $TARGET_IP
```

```bash
nmap -p 25 --script smtp-commands $TARGET_IP
# | smtp-commands: mail.company.com
# |   PIPELINING SIZE 10240000 VRFY ETRN STARTTLS AUTH PLAIN LOGIN
# |_  HELP
```

## STARTTLS and TLS Certificate

Upgrade to TLS on port 587 and check the certificate SANs for internal hostnames:

```bash
openssl s_client -starttls smtp -crlf -connect $TARGET_IP:587 2>/dev/null | grep -iE 'subject|issuer|DNS:'
# subject=CN=mail.company.com
# DNS:mail.company.com, DNS:autodiscover.company.com, DNS:smtp.company.com
```

```bash
openssl s_client -crlf -connect $TARGET_IP:465 2>/dev/null | grep -iE 'subject|DNS:'
```

Certificate SANs often reveal additional internal hostnames (autodiscover, OWA, and other Exchange-related endpoints) that are not in public DNS. Feed these into virtual host enumeration.

## NTLM Info Extraction

Exchange and other Microsoft mail servers respond to an SMTP AUTH NTLM initiation with server metadata before completing authentication. This reveals domain name, hostname, and OS version without credentials:

```bash
nmap -p 25,587 --script smtp-ntlm-info $TARGET_IP
# | smtp-ntlm-info:
# |   Target_Name: COMPANY
# |   NetBIOS_Domain_Name: COMPANY
# |   NetBIOS_Computer_Name: MAIL01
# |   DNS_Domain_Name: company.local
# |   DNS_Computer_Name: mail01.company.local
# |_  Product_Version: 10.0.17763
```

The domain name, computer name, and product version are immediately useful for AD targeting. Windows Server 2019 is version 10.0.17763. Feed the domain name into Kerberos enumeration and password spraying scope.

## User Enumeration: VRFY and EXPN

VRFY and EXPN are often disabled on hardened servers but worth checking when enabled. A 250 response confirms the user exists:

```bash
echo -e 'EHLO test\nVRFY admin\nVRFY root\nVRFY postmaster\nQUIT' | nc -nv $TARGET_IP 25
# 250 2.0.0 admin
# 550 5.1.1 <root>: Recipient address rejected
# 250 2.0.0 postmaster
```

## User Enumeration: RCPT TO

RCPT TO works even when VRFY and EXPN are blocked. The server validates the recipient locally before accepting the message. A 250 response means the address is accepted:

```bash
echo -e 'EHLO test\nMAIL FROM:<probe@test.com>\nRCPT TO:<admin@$DOMAIN>\nQUIT' | nc -nv $TARGET_IP 25
# 250 2.1.5 Ok
```

```bash
echo -e 'EHLO test\nMAIL FROM:<probe@test.com>\nRCPT TO:<nonexistent@$DOMAIN>\nQUIT' | nc -nv $TARGET_IP 25
# 550 5.1.1 <nonexistent@company.com>: Recipient address rejected: User unknown
```

## Automated User Enumeration

smtp-user-enum automates VRFY, EXPN, or RCPT testing against a wordlist. RCPT mode is most reliable:

```bash
smtp-user-enum -M RCPT -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -D $DOMAIN -t $TARGET_IP -p 25
# [*] Trying RCPT method...
# [+] admin@company.com exists
# [+] postmaster@company.com exists
# [-] test@company.com does not exist
```

```bash
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t $TARGET_IP -p 25
```

Build a confirmed user list for password spraying against OWA, SMTP submission, and other services. A 252 response to VRFY is not a positive: it means the server won't verify but will accept the message. Only treat 250 as confirmed. Move to [open relay testing](https://hackindex.io/services/smtp/vulnerability-discovery/smtp-open-relay) and [user enumeration](https://hackindex.io/services/smtp/vulnerability-discovery/smtp-user-enumeration) for dedicated methodology pages.

## References

- [nmap: smtp-commands NSE](https://nmap.org/nsedoc/scripts/smtp-commands.html) - EHLO capability enumeration via nmap
- [nmap: smtp-ntlm-info NSE](https://nmap.org/nsedoc/scripts/smtp-ntlm-info.html) - NTLM metadata extraction from Exchange SMTP
- [nmap: smtp-open-relay NSE](https://nmap.org/nsedoc/scripts/smtp-open-relay.html) - Automated open relay detection
- [smtp-user-enum](https://github.com/pentestmonkey/smtp-user-enum) - VRFY, EXPN, and RCPT user enumeration tooling