312-50 Question 98
Single answer▪ SMTP and DNS EnumerationDuring an authorized external reconnaissance test, you are asked to identify mail infrastructure and validate whether a target organization is vulnerable to user enumeration through SMTP. You have already confirmed that the organization's domain is examplecorp.com. Which sequence of actions is the most appropriate to gather this information while minimizing unnecessary noise and focusing on standard enumeration techniques?
- A
Query DNS for MX records for examplecorp.com, connect to the discovered mail server on TCP 25, and test supported SMTP commands such as VRFY or RCPT TO with non-delivery-safe probes to see whether the server reveals valid users.
- B
Perform a DNS zone transfer (AXFR) against the organization's authoritative name server and, if it fails, conclude that SMTP user enumeration is not possible because DNS and SMTP enumeration are dependent.
- C
Run a full TCP port scan against every host in the target subnet, then send spoofed phishing emails to employees and infer valid accounts based on replies and bounce messages.
- D
Query DNS for TXT records only, because TXT records typically contain mailbox lists, then use the EXPN command against the web server on TCP 80 to enumerate users.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to begin with DNS MX record enumeration and then interact directly with the SMTP service on the identified mail host. In practice, a tester may use tools such as dig, nslookup, or host to retrieve MX records, then connect with telnet, netcat, or a specialized SMTP enumeration tool to observe banner information and test supported commands. According to standard SMTP behavior defined in RFC 5321, servers may implement commands like VRFY and EXPN, although many administrators disable them to reduce information leakage. Even when those commands are disabled, SMTP recipient validation using RCPT TO can sometimes still expose account existence through response differences. From a best-practice perspective, this targeted workflow reduces noise, stays aligned with the specific objective, and reflects realistic CEH reconnaissance methodology. DNS zone transfer testing may still be worthwhile as a separate check, but it is not a prerequisite for SMTP enumeration and should not be treated as such.
- A. Correct.
Correct. This is the most appropriate sequence for SMTP and DNS enumeration in a controlled assessment. First, querying DNS MX records identifies the domain's mail exchangers, which is standard practice for locating SMTP infrastructure. Then, connecting to the SMTP service on TCP 25 allows you to enumerate capabilities and carefully test whether the server discloses user validity through commands such as VRFY, EXPN, or RCPT TO behavior. In real environments, VRFY and EXPN are often disabled, but RCPT TO during an SMTP session may still reveal whether a mailbox exists based on differing responses. This approach is targeted, practical, and minimizes unnecessary scanning noise.
- B. Incorrect.
Incorrect. Attempting AXFR can be a valid DNS enumeration technique if you are assessing whether misconfigured name servers allow zone transfer, but failure of AXFR does not imply SMTP user enumeration is impossible. DNS and SMTP are related in infrastructure discovery, but SMTP enumeration does not depend on a successful zone transfer. A candidate choosing this option may incorrectly assume that DNS disclosure is required before testing SMTP behavior.
- C. Incorrect.
Incorrect. A full subnet-wide scan is much noisier than necessary when the objective is specifically to identify mail infrastructure for a known domain. Sending spoofed phishing emails is also not an appropriate enumeration-first technique and would generally be outside the scope of safe reconnaissance unless explicitly authorized under social engineering rules. Inferring valid users from replies or bounces is indirect, operationally risky, and not the most efficient or standard CEH-style approach for SMTP enumeration.
- D. Incorrect.
Incorrect. TXT records can contain useful information such as SPF, DKIM, or domain-verification data, but they do not typically provide mailbox lists. Also, EXPN is an SMTP command and must be issued to an SMTP service, not a web server on TCP 80. This option mixes legitimate protocol names with incorrect service assumptions, which is a common misconception in enumeration questions.