SMTP:
Vulnerability Discovery
Guides on testing SMTP for open relays and user enumeration
SMTP vulnerability discovery identifies the weaknesses that make exploitation possible. Open relay testing is the first check: connect to port 25 and attempt to send mail to an external address through the server. If it accepts, you have an unrestricted relay that bypasses email security controls.
Missing or misconfigured SPF, DKIM, and DMARC records leave the domain open to spoofing. Check DNS TXT records and validate policies with tools like dig, nmap, or specialized checkers. Authentication bypass flaws in specific MTA versions (Exim, Postfix, Sendmail) appear regularly in CVE feeds and often allow unauthenticated relay or command execution.
Outdated MTA versions are the most reliable finding. Compare the banner version against known vulnerabilities. Weak AUTH mechanisms, TLS downgrade possibilities, and permissive VRFY/EXPN responses all contribute to the attack surface you will document here.