RFC 2505, section 2.11:
"Both SMTP VRFY and EXPN provide means for a potential spammer to test
whether the addresses on his list are valid (VRFY) and even get more
addresses (EXPN). Therefore, the MTA SHOULD control who is is allowed to
issue these commands. This may be "on/off" or it may use access lists
similar to those mentioned previously."
The main problem with VRFY is that it allows the spammer to
verify addresses.
I rarely see SMTP VRFY attacks..it's just as easy to do RCPT TO than SMTP
VRFY...in fact, spammers don't care if the address is valid anyway since
they often uses bogus sender addresses.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg