Notes by mraabo

Simple Mail Transfer Protocol (SMTP)

Standard application layer protocol used for sending and receiving email.

It works by establishing a connection between the Mail Server of the sender and the receiver.

It is text-based and operates on TCP port 25.

Modern mail systems use the extended version of this called Extended Simple Mail Transfer Protocol (ESMTP).

Protocol Transaction

  1. Establish connection: initiates connection between sender and receiver.
  2. Handshaking: the sender sends the e-mail address of the sender and the e-mail address of the recipient. The SMTP receiver responds and acknowledges the sender.
  3. Message transfer: The sender sends the message(s). This is done over a Persistent Connection, so if a sender has several messages to send to a mail server it can do so without having to reestablish a connection.

Commands

  • AUTH PLAIN: an extension used to authenticate the client.
  • HELO: identifies the client’s domain/hostname and initiates the session.
  • MAIL FROM: specifies the sender’s email address.
  • RCPT TO: specifies the recipient’s email address.
  • DATA: signals the start of the email content transmission.
  • RSET: aborts the current mail transaction but maintains the connection.
  • VRFY: verifies if a specific mailbox exists on the server.
  • EXPN: expands a mailing list to show its constituent members.
  • NOOP: requests a response from the server to keep the connection alive.
  • QUIT: terminates the session.

Enumeration

The command VRFY can be used to enumerate existing users on the system. Since this is a known vulnerability, some servers disable this command or configure their server to provide a fixed reply to this command without regards to whether the user exist or not.

Security

SMTP is by itself unencryptet but it is often used in combination with SSL or TLS.

Users are not authenticated. To prevent spam one must use the identification protocols DKIM and/or SPF.

Examples

Messages exchanged between an SMTP client (C) and SMTP server (S):

S: 220 hamburger.edu
C: HELO crepes.fr
S: 250 Hello crepes.fr, pleased to meet you
C: MAIL FROM: <alice@crepes.fr>
S: 250 alice@crepes.fr ... Sender ok
C: RCPT TO: <bob@hamburger.edu>
 
S: 250 bob@hamburger.edu ... Recipient ok
C: DATA
S: 354 Enter mail, end with ”.” on a line by itself C: Do you like ketchup?
C: How about pickles?
C: .
S: 250 Message accepted for delivery
C: QUIT
S: 221 hamburger.edu closing connection

Graph View

Backlinks