312-50 Question 37
Single answer▪ Email FootprintingDuring an authorized reconnaissance phase, a security consultant needs to verify whether several employee email addresses at examplecorp.com are valid without sending messages to end users or triggering mailbox content delivery. The consultant wants to use a technique commonly associated with email footprinting that relies on the target mail server's SMTP behavior. Which action is the MOST appropriate?
- A
Connect to the target MX server over SMTP and issue VRFY or RCPT TO commands in a controlled manner to test whether specific addresses are accepted
- B
Send phishing-style test emails with tracking pixels to each suspected address and wait for message opens
- C
Query public DNS for a TXT record that lists all valid employee email addresses for the domain
- D
Perform a WHOIS lookup on the domain to retrieve the organization's complete internal email directory
Show answer and explanation
Correct answer: A
Explanation
In CEH-style reconnaissance, email footprinting focuses on discovering email addressing schemes, mail servers, and sometimes validating specific mailboxes. A practical and historically common method is SMTP user enumeration against the domain's MX server. Relevant SMTP behavior is defined in RFC 5321, which documents commands such as VRFY, EXPN, and RCPT. In real environments, VRFY and EXPN are often disabled, and some servers intentionally return uniform responses or accept all RCPT TO requests at the SMTP stage to prevent enumeration. Even so, testing SMTP responses in a controlled, authorized manner is the best fit for the scenario because it attempts validation without sending actual mailbox content to end users. By contrast, DNS and WHOIS can support email footprinting indirectly by revealing MX records, SPF, and administrative contacts, but they do not enumerate valid employee inboxes.
- A. Correct.
Correct. Email footprinting often includes enumerating valid addresses by interacting directly with the target's mail infrastructure, typically the MX host. SMTP commands such as VRFY, EXPN, and, more commonly in modern environments, RCPT TO can sometimes reveal whether a mailbox exists based on server responses. This approach aligns with the requirement to avoid delivering content to end users, although many servers disable VRFY/EXPN and may also use catch-all behavior or anti-enumeration controls.
- B. Incorrect.
Incorrect. Sending phishing-style emails with tracking pixels is not an appropriate validation method for this requirement because it delivers content to users and introduces social engineering activity rather than passive or low-impact footprinting. It also creates unnecessary risk and would typically require explicit scope and approval beyond simple email reconnaissance.
- C. Incorrect.
Incorrect. DNS TXT records are commonly used for SPF, DKIM selectors, DMARC policies, and other domain-related metadata, but they do not provide a published directory of all valid employee mailboxes. Choosing this option reflects a misunderstanding of what email-related DNS records are designed to expose.
- D. Incorrect.
Incorrect. WHOIS data may contain registrar and administrative contact information, but it does not provide a complete list of valid internal user email addresses. Relying on WHOIS for mailbox enumeration confuses domain registration metadata with operational mail directory information.