smtp.banner.version_leak

MTA Software Leaked in Banner

What we check

We parse the SMTP banner for MTA software names and version numbers. Revealing the exact software and version in the banner provides attackers with information they can use to target known vulnerabilities.

What this finding means

The SMTP banner includes the MTA software name and/or version number (e.g., Postfix 3.5.6, Exim 4.96, Microsoft ESMTP MAIL Service). While not a vulnerability itself, it reduces the effort an attacker needs to find applicable exploits.

Why it matters

Targeted exploitation. An attacker who knows the exact MTA version can search for CVEs and known exploits specific to that release, skipping the fingerprinting step.
Patch-level exposure. If the version number reveals an unpatched release, the server becomes a higher-priority target.
Easy to prevent. Removing version information from the banner is a one-line configuration change with no operational downside.

How to fix

Remove version information from the banner. For Postfix:
```
# /etc/postfix/main.cf
smtpd_banner = $myhostname ESMTP
```
This removes the default (Ubuntu) or Postfix suffix. Do not include the software name or version.
Reload Postfix:
```
postfix reload
```
For Exim: set smtp_banner to omit version details. For Microsoft Exchange: the banner is not easily customizable, but hosted Exchange (Microsoft 365) uses a generic banner by default.

How it's graded

A version leak in the banner is informational and carries no penalty. It is flagged as a security hardening recommendation. See Grading Methodology for the full scoring model.

Evidence example

S: 220 mail.example.com ESMTP Postfix (Ubuntu 3.5.6-1)
                                       ^^^^^^^^^^^^^^^^ software version exposed

References

RFC 5321 — Simple Mail Transfer Protocol