Bounce Information Disclosure

[StrangeUSB]

I would like to verify if the mail server notifies the sender that the user isn't a valid recipient.

[jordan-wright]

This one might be tricky, since I'll need to create a mail server and track bounces, but I'll give it a shot!

[StrangeUSB]

Yeah, depending on when the validation takes place that will be required. I know Google and other major receivers will accept the message and send a bounce after if the recipient isn't valid. I think there could be other uses-cases for such monitoring as well. This also become an UX issue for how notify the original user of the tool, since the message was technically accepted the GUI will at some point show a successful test.

[jordan-wright]

We could also use this to check for general information disclosure from bounced messages, such as which AV is used (source).