// HackTricks · Network Services

SMTP Commands

SMTP Commands

SMTP is a text protocol. After the server greeting, a client normally sends EHLO; the server’s multiline response advertises supported extensions. A basic mail transaction then uses MAIL FROM, one or more RCPT TO commands, and DATA.[1]

Core commands[1]

  • EHLO <domain>: Identifies an Extended SMTP client and requests the server’s extension list.
  • HELO <domain>: Legacy greeting used when ESMTP is unavailable.
  • MAIL FROM:<reverse-path>: Starts a transaction and sets its envelope sender. This is not the message’s From: header.
  • RCPT TO:<forward-path>: Adds one envelope recipient; repeat it for additional recipients.
  • DATA: Requests permission to transmit the message headers and body. A 354 reply means the client may send the content, terminated by a line containing only a dot.
  • RSET: Aborts the current transaction and clears its sender, recipients, and data without closing the SMTP connection.
  • VRFY <string>: Requests confirmation that a string identifies a user or mailbox. Servers commonly disable useful responses to reduce enumeration.
  • EXPN <string>: Requests expansion of a mailing list. Servers may disable it.
  • HELP [command]: Requests general or command-specific help.
  • NOOP: Requests a successful reply without changing transaction state.
  • QUIT: Ends the SMTP session.

Common extensions

  • SIZE [bytes]: The server advertises its maximum accepted message size; the client may declare the planned message size on MAIL FROM.[2]
  • AUTH <mechanism>: Starts SMTP authentication using a mechanism advertised in the EHLO response. Credentials are not necessarily encrypted, so negotiate TLS first unless the selected mechanism provides adequate protection.[3]
  • STARTTLS: Requests an upgrade of the connection to TLS. After a successful TLS negotiation, the client sends EHLO again because the advertised extensions can change.[4]

The obsolete TURN command from RFC 821 reversed the client and server roles on an existing connection. RFC 5321 no longer defines it, so do not expect current servers to support it.[1][5]

For a shorter operator-oriented catalog of these commands, the original page used ServerSMTP’s command overview.[6]

References

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.