SMTP user enumeration (VRFY/EXPN/RCPT)

The SMTP protocol (port 25) includes commands meant to verify recipients which, when misconfigured, let you find out which accounts exist on the system without authenticating. There are three:

• VRFY <user>: asks the server to verify whether a user exists.
• EXPN <list>: expands a mailing list to its members.
• RCPT TO:<user>: in a send session, the server accepts or rejects the recipient.

The response distinguishes what exists from what doesn't. With VRFY, a valid user usually returns 252 (or 250) and a non-existent one a 550. By hand:

nc <ip> 25
EHLO test
VRFY michael      # 252 -> exists
VRFY nouser       # 550 -> doesn't exist

To automate, iterate a username wordlist (e.g. xato-net-10-million-usernames.txt) filtering by the success code. Since each request can be slow, parallelise it:

while read -r u; do
  r=$(echo -e "VRFY $u" | nc -w1 <ip> 25 | grep -c 252)
  [ "$r" = "1" ] && echo "[+] $u exists"
done < users.txt

Why it matters. Confirming real users (michael, root...) narrows an SSH brute force, gives names to test credential reuse, or corroborates accounts seen elsewhere (an LFI of /etc/passwd, for example). It's pure enumeration, but very profitable.

How to detect it. The pattern is unmistakable in the mail server logs: a burst of VRFY/EXPN or RCPT TO commands with many distinct recipients from a single IP in a short window, with a high proportion of 550 responses (non-existent user). In Postfix, that fills /var/log/mail.log with NOQUEUE: reject or VRFY lines; a fail2ban or SIEM rule counting failed VRFY/RCPT per source detects it. On the network, port-25 traffic full of VRFY from a host that is not a legitimate MTA is the signal. The key is the volume of probes per source, not a single query.

Defence. Disable VRFY and EXPN (disable_vrfy_command = yes in Postfix), and configure the server to respond the same to valid and invalid recipients so RCPT doesn't leak information. Related to the password spraying that usually follows.