DΛΣMӨП

// HackTricks · Network Services

SMTP Commands

SMTP Commands

SMTP is a text protocol. After the server greeting, a client normally sends EHLO; the server’s multiline response advertises supported extensions. A basic mail transaction then uses MAIL FROM, one or more RCPT TO commands, and DATA.[1]

Core commands[1]

  • EHLO <domain>: Identifies an Extended SMTP client and requests the server’s extension list.
  • HELO <domain>: Legacy greeting used when ESMTP is unavailable.
  • MAIL FROM:<reverse-path>: Starts a transaction and sets its envelope sender. This is not the message’s From: header.
  • RCPT TO:<forward-path>: Adds one envelope recipient; repeat it for additional recipients.
  • DATA: Requests permission to transmit the message headers and body. A 354 reply means the client may send the content, terminated by a line containing only a dot.
  • RSET: Aborts the current transaction and clears its sender, recipients, and data without closing the SMTP connection.
  • VRFY <string>: Requests confirmation that a string identifies a user or mailbox. Servers commonly disable useful responses to reduce enumeration.
  • EXPN <string>: Requests expansion of a mailing list. Servers may disable it.
  • HELP [command]: Requests general or command-specific help.
  • NOOP: Requests a successful reply without changing transaction state.
  • QUIT: Ends the SMTP session.

Common extensions

  • SIZE [bytes]: The server advertises its maximum accepted message size; the client may declare the planned message size on MAIL FROM.[2]
  • AUTH <mechanism>: Starts SMTP authentication using a mechanism advertised in the EHLO response. Credentials are not necessarily encrypted, so negotiate TLS first unless the selected mechanism provides adequate protection.[3]
  • STARTTLS: Requests an upgrade of the connection to TLS. After a successful TLS negotiation, the client sends EHLO again because the advertised extensions can change.[4]

The obsolete TURN command from RFC 821 reversed the client and server roles on an existing connection. RFC 5321 no longer defines it, so do not expect current servers to support it.[1][5]

For a shorter operator-oriented catalog of these commands, the original page used ServerSMTP’s command overview.[6]

References