M04-06 · SMTP enumeration

What does SMTP do?

SMTP (Simple Mail Transfer Protocol) submits and transfers email.

Think of a post-office counter: check that it is open, ask about services, provide a destination, and then hand over the letter. Acceptance at one step and arrival at the recipient are different stages.

SMTP enumeration collects greetings, advertised features, and command replies to inventory mail systems and review information exposure. SMTP specification

Where do ports 25, 587, and 465 fit?

• TCP 25: the standard port for transferring mail between servers. • TCP 587: the standard port for a mail client to submit a message. • TCP 465: message submission using implicit TLS; TLS negotiation begins as the connection starts.

Submission is like handing a letter to your own post office. Server-to-server transfer is the delivery network passing it along. Check protocol replies and administrative settings to identify the actual service and policy. Message submission · Submission and TLS

Which commands and replies matter?

Start with what each command asks: • EHLO introduces the client and requests advertised extensions; HELO is the basic greeting. • VRFY asks the server to verify user or mail-address information. • EXPN asks it to expand a mailing list. • RCPT TO proposes a recipient in a mail transaction. • QUIT ends the connection.

Policy can restrict information from VRFY and EXPN. Interpret a RCPT TO reply in the context of that transaction.

A 252 reply says verification could not be completed but expresses willingness to accept a message and attempt delivery. Address validity still needs checking. A 550 reply may involve a missing address, an access restriction, or policy refusal; retain the full reply.

For 250, record the command it answers. Accepting a recipient and taking responsibility after receiving the complete message are different stages. Check delivery records for the eventual outcome. Commands and replies

Enhanced codes such as 5.1.1 and 5.7.1 can help distinguish address problems from policy problems. Read them alongside the command, full reply, and server logs. Enhanced status codes

What do STARTTLS and AUTH each do?

STARTTLS upgrades an existing SMTP connection to TLS. An advertised STARTTLS capability tells you the server offers it. Verify successful negotiation, certificate validation, and effective settings to establish the protection actually used.

After TLS is established, send EHLO again to obtain the current feature list, which may have changed. STARTTLS specification

AUTH performs authentication. Listing AUTH methods advertises capability; completing authentication and receiving a success reply provides evidence for that authentication attempt. Authorization policy still determines which destinations the identity may send to. SMTP authentication

TLS protects the connection, AUTH verifies identity, and relay policy determines permitted use. Check each one.

Connect the ideas with a made-up example

This is a synthetic authorized-lab record. No connection, query, or message was sent. The server and test names have been agreed on:

• Connect: receive a 220 greeting. • Send EHLO: receive a feature list including STARTTLS. • Verify the agreed synthetic name labuser: VRFY returns 252. • End the connection. Authentication, recipient testing, and message submission are untested in this example.

A useful record says:

“The SMTP service replied with a greeting and advertised STARTTLS. Verification of labuser returned 252; address validity needs checking. This record captures advertised capabilities and the verification reply. TLS negotiation, sign-in, delivery, and relay capability require separate evidence.”

The result is a record of service capabilities and verification replies. Add evidence for each further question you need to answer.

How do you protect the service and preserve evidence?

Start with the service’s intended purpose:

• Limit VRFY and EXPN availability and disclosure to administrative situations that need them. • Define recipient domains and relay policy so unauthorized outside senders cannot use the server to relay to outside destinations—an open relay. • Require appropriate authentication and TLS for submission, and protect credentials. • Review high volumes of address queries, failed authentication, and unusual mail transactions alongside limits and logs. SMTP abuse prevention · Transport protection for submission

Record time, source location, target and port, TLS and authentication state, command stage, and the complete reply. To verify delivery or relaying, separately agree on controlled sending and receiving endpoints and delivery evidence.

Use synthetic addresses in public teaching. Keep credentials, message contents, and real recipient details in protected records.

One small check

A server lists STARTTLS in its EHLO reply and returns 252 to VRFY labuser. A colleague says, “That proves labuser exists and we have already sent a message over an encrypted connection.”

In two or three sentences, what have you established? What evidence would establish connection encryption, address validity, and message delivery?

This check awaits your answer. The site does not submit answers or update understanding. Q&A awaits actual questions and discussion. Next is M04-07 Unix/Linux user enumeration.

Concept Q&A

Pending: related questions will be edited into anonymous teaching notes when available.