Free Tool

Mail Server Fingerprinting

Identify your mail server's software, SMTP extensions, authentication mechanisms, and configuration details from its EHLO response.

Free instant check — no signup required

How SMTP Fingerprinting Works

When an email client or server connects to an SMTP server, it sends an EHLO (Extended Hello) command. The server responds with its capabilities — a list of SMTP extensions it supports, size limits, authentication methods, and often its software identity in the banner message.

This tool connects to your domain's MX (mail exchange) server and analyzes the EHLO response to extract useful information. It identifies the mail server software (such as Postfix, Microsoft Exchange, Google SMTP, Exim, or Sendmail), supported SMTP extensions like STARTTLS, PIPELINING, and 8BITMIME, and available authentication mechanisms like PLAIN, LOGIN, or XOAUTH2.

Understanding your mail server's fingerprint is valuable for security auditing. You can verify that STARTTLS is available for encrypted connections, check if the server is revealing too much information in its banner, and ensure modern extensions are enabled for compatibility and performance.

For a deeper security analysis, combine this with our catch-all detector and domain security report for a comprehensive view of your email infrastructure.

Frequently Asked Questions

What is SMTP server fingerprinting?
SMTP server fingerprinting is the process of identifying mail server software, its version, and its capabilities by analyzing the EHLO response and banner message. By examining what extensions a server advertises (STARTTLS, AUTH mechanisms, SIZE limits, etc.) and its banner text, you can determine what software runs it — Postfix, Exchange, Exim, Sendmail, or a hosted provider like Google or Microsoft.
Why should I hide my mail server version?
Exposing the exact version number of your mail server software helps attackers identify known vulnerabilities. If your server reveals it runs Postfix 3.5.1, and that version has a known CVE, an attacker can target it directly. Security best practice is to customize the banner to remove or obscure version information. However, keeping software patched is more important than obscuring versions.
What information does an SMTP banner reveal?
An SMTP banner (the greeting sent when a client connects) typically contains the server hostname and often the software name and version. The subsequent EHLO response reveals supported extensions: STARTTLS for encryption, AUTH mechanisms (PLAIN, LOGIN, XOAUTH2), SIZE limits, PIPELINING, 8BITMIME, SMTPUTF8, DSN, and more. Together these reveal the server's capabilities and configuration.
How do attackers use SMTP fingerprinting?
Attackers use SMTP fingerprinting as a reconnaissance step before launching targeted attacks. Knowing the software and version helps them look up known vulnerabilities. Knowing supported AUTH mechanisms can guide brute-force or credential-stuffing attempts. Identifying whether VRFY or EXPN are enabled allows user enumeration. For publicly accessible mail servers, minimizing information disclosure reduces your attack surface.
How do I hide my mail server banner?
In Postfix, set 'smtpd_banner = $myhostname ESMTP' in main.cf to remove the version number. In Exim, set 'smtp_banner = ${primary_hostname} ESMTP'. In Microsoft Exchange, you can modify the banner via the Exchange Management Shell. Most servers allow full customization — a minimal banner like 'mail.example.com ESMTP' reveals only the hostname without software details.

Need continuous monitoring?

Get automatic alerts when your mail server configuration changes. Monitor SMTP security, blacklists, and DNS records.

Start Monitoring Free