SMTP User Enumeration: How Attackers Learn Your Email Addresses

Before an attacker can phish you, they need to know who to phish. Some mail servers will tell them. The technique is called SMTP user enumeration, and it is one of the quieter steps that sits ahead of phishing and business email compromise.

What it is

SMTP is the protocol mail servers use to hand messages to each other. Two old commands, VRFY and EXPN, were designed to help administrators. VRFY asks whether a username exists. EXPN asks a server to expand a mailing list into its members. Separately, a server’s reply to the RCPT command during delivery can reveal whether a recipient address is valid, because a valid address is accepted and an invalid one is rejected.

If a server answers these honestly to anyone who asks, a person can test thousands of guesses and keep the ones that work. Names are easy to guess. Most organizations use a predictable format, such as first initial plus surname.

Penetration testers use this on purpose, because a confirmed list of valid users is the starting point for password spraying or targeted phishing. Criminals do the same.

Why it matters for BEC

A valid-address list changes the economics of an attack. Instead of blasting a guess at every possible name, an attacker can aim at the finance team, the executive assistant, or the person who approves payments. The attack gets quieter and more believable.

Enumeration also helps with lookalike attacks. Once someone knows your address format and who works in which role, a convincing request that appears to come from a colleague is easy to write.

How to reduce the exposure

If you run your own mail servers or relays:

Disable VRFY and EXPN, or make them return a generic response.
Test what your server says about unknown recipients from the outside. Where practical, accept mail first and bounce later rather than revealing validity at the door.
Rate-limit and alert on bursts of failed recipient lookups from one source. A cluster of rejections for names that do not exist is a signal worth watching.
Keep public posting of staff addresses sensible. A contact form leaks less than a published directory.

For any organization, including those on cloud email:

Assume attackers can learn your address format anyway. Public sources, press releases and social media make it easy. Do not rely on obscurity.
Pay attention to your allow lists. Microsoft’s documentation warns that senders on the allowed senders and allowed domains lists bypass most email protection, and that entries create a high risk of attackers delivering mail that would otherwise be filtered. Use them for temporary testing, not as a standing workaround.
Publish and enforce email authentication (SPF, DKIM and DMARC). Microsoft notes that the DMARC policy for an allowed domain should be set to p=reject. A strict policy makes it harder to spoof your own domain.
Protect the accounts, not the secrecy of the names. Strong sign-in and conditional access matter more than hiding that a mailbox exists.

What to test

1. From outside your network, check whether VRFY and EXPN respond on any mail host you run.

2. Compare the response for a real and a fake recipient. If they differ clearly, enumeration is possible.

3. Review logs for repeated recipient rejections from a single address.

4. Confirm that new mail rules and external forwarding generate alerts, since that is the next stage if a mailbox is taken over.

The honest summary: you cannot keep your address format secret, so the goal is to make a guessed address worthless without a second factor, a verification process, and someone watching.

If you would like a hand reviewing your mail exposure, message us to talk it through.

See how we help with incident response and security services.