Can I trick a mail server into sending me an email? I would like to do some email header analysis on the emails that are send by a mail-server in a penetration-test and possibly get to know more information about the targets like: hostnames, IP-addresses, software and software versions.
I thought about trying to fill in some forms that contain an email field in order to possibly trigger an outgoing mail-event. But I want it to be more low profile. Since such mail-event will trigger and internal (mail) event as well.
Also I thought about sending an email to a non-existing email address in order to get it bounced back. But that won't work when they use a catch-all policy.
In other words: Can I trigger or force an mailserver to send an email to a desired mail address, owned by me?