search

gophish / healthcheck

A service to test mail servers for best practices.
MIT License
34 stars 7 forks source link

Bounce Information Disclosure #3

Open StrangeUSB opened 6 years ago

StrangeUSB commented 6 years ago

I would like to verify if the mail server notifies the sender that the user isn't a valid recipient.

jordan-wright commented 6 years ago

This one might be tricky, since I'll need to create a mail server and track bounces, but I'll give it a shot!

StrangeUSB commented 6 years ago

Yeah, depending on when the validation takes place that will be required. I know Google and other major receivers will accept the message and send a bounce after if the recipient isn't valid. I think there could be other uses-cases for such monitoring as well. This also become an UX issue for how notify the original user of the tool, since the message was technically accepted the GUI will at some point show a successful test.

jordan-wright commented 6 years ago

We could also use this to check for general information disclosure from bounced messages, such as which AV is used (source).