I'm testing my SMTP server using metasploit to see what information I can extract. Currently I'm trying to enumerate SMTP users using smtp_enum module.

I've encountered a problem, the server introduces itself as mail.example.com in the banner and metasploit uses this as a domain name, trying emails like <something>@mail.example.com.

Of course the server serves example.com domain, not to mention that it also serves several different domains.

I looked through options, documentation and several online guides, but I haven't found a way to set the domain name I want tested.

I found this question which discusses using VHOST for that purpose, but it seems smtp_enum doesn't have that option.

Is it possible to ignore name provided by the server in the banner and test emails like <something>@example.com and <something>@otherdomain.com?

1 Answer 1


No need to use metasploit for this. The smtp-user-enum tool should do what you are looking for. If it's not already installed in Kali, you should be able to install it using apt install smtp-user-enum or else you can clone the GitHub repository.

Specify the -D flag to target the domain you need. E.g.:

$ smtp-user-enum -D otherdomain.com -U users.txt -t example.com

  • It seems to do the trick, however it uses x as the source host in HELO which makes the server reject the connection with Helo command rejected: need fully-qualified hostname;. But I think I can solve this problem modifying the code. Thanks!
    – daneos
    Aug 19, 2023 at 19:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .