smtp.vrfy.enabled
VRFY Command Enabled
What we check
We send a VRFY command to the mail server to test whether it confirms the existence of user mailboxes. VRFY was designed for debugging, but it allows anyone to probe whether a specific email address exists on the server.
What this finding means
The server responds to VRFY commands, confirming or denying the existence of individual mailboxes. An attacker can use this to enumerate valid email addresses before launching targeted phishing or brute-force attacks.
Why it matters
- Address enumeration. VRFY lets an attacker systematically discover which addresses are valid, building a targeted list for spear-phishing or credential-stuffing attacks.
- Reconnaissance tool. Combined with other information (company directories, LinkedIn), VRFY accelerates mapping of an organization's mail infrastructure.
- Low practical utility. Legitimate use of VRFY is rare. Modern mail systems provide no administrative benefit from leaving it enabled.
How to fix
Disable VRFY. For Postfix:
# /etc/postfix/main.cf disable_vrfy_command = yesReload Postfix:
postfix reloadFor other MTAs: Exim:
acl_smtp_vrfy = deny; Sendmail: addgoawaytoPrivacyOptions.
How it's graded
VRFY enabled is informational and carries no penalty. It is flagged as a security hardening recommendation. See Grading Methodology for the full scoring model.
Evidence example
C: VRFY admin
S: 252 2.0.0 admin@example.com