SMTP VRFY Command for User Enumeration
Which of the following commands checks for valid users on an SMTP server?
Community Votes
75% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests knowledge of SMTP enumeration commands, specifically distinguishing between verifying a single user (VRFY) and expanding a mailing list (EXPN).
The VRFY command in SMTP is used to verify if a specific email user exists on the server. This page explains why VRFY is the correct answer over EXPN and other options.
Candidates often confuse VRFY with EXPN. While VRFY checks a specific user, EXPN expands a mailing list, which might be misinterpreted as checking 'users' generally.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The VRFY (Verify) command is explicitly designed to check if a specific mailbox or user exists on an SMTP server. When sent with a username, it returns a status indicating whether that user is valid. This makes it a primary tool for user enumeration during reconnaissance.Why the Other Options Are Wrong
RCPT TO specifies the recipient for a message but does not inherently verify existence without sending the message. CHK is not a standard SMTP command. EXPN (Expand) is used to expand a mailing list, showing all members, rather than verifying a single user's validity directly like VRFY.Community Comment Notes
Community consensus strongly favors C. As one commenter noted, "The VRFY (Verify) command... is used to check if a specific user exists." Another highlighted the distinction: "as it asked for users it is D" was a minority view, but most agreed VRFY is the direct verification tool.Exam Strategy
Memorize the specific purpose of each SMTP command. Distinguish clearly between VRFY (verify user) and EXPN (expand list) as they are frequently tested together.
Frequently Asked Questions
What is the difference between VRFY and EXPN?
VRFY verifies if a single specific user exists. EXPN expands a mailing list to show all its members.
Why is RCPT not the answer?
RCPT TO defines the recipient for a transaction but doesn't explicitly return a validity check response code for existence like VRFY does.