312-50 Question 39
Single answer▪ Email FootprintingDuring a sanctioned reconnaissance phase, you need to verify whether specific employee email addresses at examplecorp.com are valid without sending messages to end users or relying on third-party breach data. The client allows passive and low-impact enumeration against publicly reachable infrastructure only. Which approach is the MOST appropriate for email footprinting in this scenario?
- A
Query the domain's MX records, connect to the mail server over SMTP, and use commands such as VRFY or RCPT TO to test whether candidate addresses are accepted
- B
Send a tracking-enabled phishing email to each suspected address and record which recipients open the message
- C
Perform a zone transfer (AXFR) against the domain's DNS servers to retrieve all employee mailboxes directly
- D
Use WHOIS output to enumerate all active employee email addresses because registrars maintain current user mailbox listings
Show answer and explanation
Correct answer: A
Explanation
For CEH-style email footprinting, the most defensible and practical method here is SMTP-based verification after identifying the target's MX records. The process typically starts with DNS reconnaissance to locate mail exchangers, followed by controlled SMTP interaction to assess whether the server discloses recipient validity through VRFY, EXPN, or RCPT TO responses. This is consistent with how mail transfer agents handle recipient validation, although many modern systems intentionally restrict these commands to reduce user enumeration. Relevant best-practice references include SMTP behavior defined in RFC 5321 and the long-standing security recommendation to disable or restrict VRFY/EXPN on production mail servers. The other options either exceed scope, rely on incorrect assumptions about DNS/WHOIS, or involve prohibited interaction with end users.
- A. Correct.
Correct. A standard email-footprinting technique is to identify the organization's mail exchangers via DNS MX records and then perform controlled SMTP enumeration against the exposed mail service. Depending on server configuration, commands such as VRFY, EXPN, or testing recipient acceptance with MAIL FROM/RCPT TO may reveal whether an address exists. This aligns with the requirement to avoid contacting end users directly and stays within low-impact reconnaissance when done carefully and with authorization. In practice, many servers disable VRFY/EXPN, so RCPT TO behavior may be the only available indicator.
- B. Incorrect.
Incorrect. Sending tracking-enabled phishing messages directly targets end users and crosses from reconnaissance into active social engineering. It also violates the scenario constraint of not sending messages to users. A candidate might choose this because it can validate mailbox activity, but it is not an appropriate email-footprinting method under the stated rules.
- C. Incorrect.
Incorrect. DNS zone transfers can sometimes expose hostnames when misconfigured, but they do not normally return employee mailbox accounts. Even if AXFR were allowed by a poorly configured server, it would enumerate DNS records, not a list of user email addresses. This distractor reflects the misconception that DNS contains all user-level mail identities.
- D. Incorrect.
Incorrect. WHOIS records may contain administrative or registrant contact addresses for a domain, but they do not provide a maintained directory of all employee mailboxes. A candidate might confuse domain registration contacts with operational email account enumeration. WHOIS is useful for domain ownership and contact metadata, not for validating individual employee addresses.