What useful information is gathered during a successful Simple Mail Transfer Protocol (SMTP) enumeration?

The SMTP VRFY command instructs a mail server to verify whether a specific username or email address is valid and exists locally, while the EXPN command expands a mailing list alias to expose all individual recipient addresses. Both commands are enabled by default on many misconfigured mail servers and can be queried without authentication, allowing an attacker to build a confirmed list of valid accounts. This information is directly useful for targeted phishing, credential stuffing, or brute-force attacks against the organization.

SMTP protocol commands do not expose server-side rate limits, daily message quotas, or mailbox lock thresholds, as those are internal server configuration values inaccessible via the SMTP command set.

RCPT TO is a standard SMTP delivery command used to specify a recipient address during the mail transfer process and does not return a list of open ports.

Mail proxy or relay server addresses are discovered through external DNS record analysis such as MX and SPF lookups, not through direct SMTP command interaction with a target host.