312-50 Question 38
Single answer▪ Email FootprintingDuring an authorized reconnaissance phase, you need to confirm whether the target organization uses a third-party email security gateway and identify the actual mail servers that receive inbound email for the domain examplecorp.com. Which action would provide the most reliable evidence for email footprinting without sending phishing messages or attempting to bypass controls?
- A
Query the domain's MX records and then investigate the returned hosts' DNS names, IP ownership, and SMTP banner responses where permitted
- B
Run a WHOIS query against the target domain and use only the registrant contact email address as proof of the mail infrastructure
- C
Perform a DNS zone transfer against the target's name servers because mail server details are always exposed there if email is hosted externally
- D
Send malformed SMTP commands to random public IP addresses in the target's ASN and treat any 220 response as confirmation of the production mail gateway
Show answer and explanation
Correct answer: A
Explanation
For CEH-style email footprinting, the most defensible and practical workflow is to begin with DNS reconnaissance, especially MX records, because they directly indicate which hosts are responsible for receiving mail for a domain. From there, you can identify whether those MX hosts belong to the target or a third-party provider by examining DNS naming patterns, passive DNS data, IP ownership, and, where permitted, SMTP service information. This is consistent with standard email routing behavior defined in the SMTP framework and DNS mail exchange usage, including RFC 5321 for SMTP and RFC 1035 for DNS. In practice, security gateways and hosted email platforms often expose recognizable MX hostnames, making MX analysis one of the most reliable methods for email footprinting during authorized reconnaissance.
- A. Correct.
Correct. Checking MX records is a standard first step in email footprinting because MX records identify the hosts designated to receive email for a domain. Investigating the returned hostnames can reveal whether the organization uses providers such as Microsoft 365, Google Workspace, Proofpoint, Mimecast, or other secure email gateways. Correlating DNS names, IP ownership, and permitted SMTP banner information gives stronger evidence than relying on a single source. This approach is targeted, minimally invasive, and aligned with legitimate reconnaissance practices.
- B. Incorrect.
Incorrect. WHOIS data may contain administrative or registrant email addresses, but it does not reliably identify the actual inbound mail infrastructure. Many organizations use privacy services, third-party registrars, or different email hosting providers, so the contact email in WHOIS is weak evidence for determining the active mail path.
- C. Incorrect.
Incorrect. A DNS zone transfer can reveal extensive DNS information, including mail-related records, but it should not be assumed to be available. Properly configured authoritative DNS servers usually restrict AXFR transfers. The statement that mail server details are always exposed there is false, making this an unreliable and incorrect primary method.
- D. Incorrect.
Incorrect. Randomly probing public IPs in the target's ASN is noisy, imprecise, and may touch unrelated services or systems. A 220 SMTP banner only shows that an SMTP service is listening on that IP; it does not prove that the host is the domain's actual inbound mail gateway. Good email footprinting starts from domain-specific records such as MX and then validates them.