smtp.expn.enabled
EXPN Command Enabled
What we check
We send an EXPN command to the mail server to test whether it expands mailing list addresses, revealing their individual members. Like VRFY, EXPN was designed for debugging but has become a security concern.
What this finding means
The server responds to EXPN commands, revealing the individual recipients behind mailing list aliases. An attacker can use this to discover internal distribution lists and their membership.
Why it matters
- Mailing list exposure. EXPN reveals who belongs to internal lists (e.g.,
all-staff@,finance@), information that is useful for social engineering and targeted attacks. - Deeper than VRFY. While VRFY confirms single addresses, EXPN can reveal entire groups of users in one request, accelerating reconnaissance.
- Rare in modern deployments. Postfix does not implement EXPN by default. Its presence suggests either an older MTA or explicit (and likely unnecessary) configuration.
How to fix
Disable EXPN in your MTA configuration. Postfix does not support EXPN by default — no action needed. If you are running Sendmail:
O PrivacyOptions=goawayFor Exim, ensure no ACL grants EXPN access to untrusted sources.
Reload your MTA after changes.
How it's graded
EXPN enabled is informational and carries no penalty. It is flagged as a security hardening recommendation. See Grading Methodology for the full scoring model.
Evidence example
C: EXPN staff
S: 250-alice@example.com
S: 250-bob@example.com
S: 250 carol@example.com