Search code examples
windowssmtpscanning

What is the purpose of a SMTP VRFY Scanner?


I need some assistance with these type of scanners, there seem to be many of them on the web but I can't seem to find specific details of what they are meant to achieve.

I understand that they are communicating on the SMTP port, but I am not certain of what type of information they are trying to get.

The reason I ask this is because I am currently investigating a SMTP VRFY Scanner. I have made the scanner to connect to a windows xp system but it states

Waiting for SMTP banner
220 testing221 Microsoft ESMTP MAIL Service, Version: 6.0.2600.2180 ready at  Sun, 27 Sep 2015 19:04:44 +0100 

testing221 corresponds to the domain on the SMTP virtual server, on the xp system.


Solution

  • The SMTP VRFY command is intended to allow a sender to verify the correctness of an email address without actually sending an email.

    This feature was abused by spammers very early on. As a result, most SMTP servers are configured to ignore the command.

    They are effectively useless for the public internet these days. You will find very few, if any, domains configured to support the command.