SMTP & Email Security Assessment

This guide treats SMTP gateways, submission services, and email authentication controls as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Map MX records, inbound gateways, outbound relays, and submission endpoints.

2. 02

   Identify trusted relay sources and authenticated submission flows.

3. 03

   Record SPF, DKIM, DMARC, MTA-STS, and TLS-RPT ownership.

4. 04

   Define privacy limits before testing address-validation behavior.

dig +short MX example.com
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short TXT _mta-sts.example.com

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Confirm unauthenticated relay attempts are rejected using synthetic sender and recipient domains.

2. 02

   Verify submission requires approved authentication and transport encryption.

3. 03

   Compare invalid and valid synthetic recipients without enumerating real users.

4. 04

   Review DMARC alignment and handling against the organization policy.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Alert on relay anomalies, authentication failures, spoofing attempts, and mail-flow changes.
• Monitor DMARC aggregate reports and transport-security failures.
• Protect mail logs because they contain addresses and message metadata.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Restrict relay by identity and source.
• Enforce modern TLS for authenticated submission.
• Align SPF and DKIM with DMARC and phase toward enforcement.
• Reduce recipient-enumeration differences and rate-limit abuse.