If you are lucky your exchange server will be the smart picky kind.
Then when you go to compsoe a fake email, you have to send it a list of recipients.
For example if your mail server controls @mydomain.com
You start a mock email and send it a RCPT TO with the email address.
If you send say
Jones@mydomain.com it will look in it's own records for a Jones user.
Here is an exmple from the RFC pages on SMTP:
-
S: RCPT TO:<Jones@mydomain.com>
-
R: 250 OK
-
-
S: RCPT TO:<Green@mydomain.com>
-
R: 550 No such user here
-
-
S: RCPT TO:<Brown@mydomain.com>
-
R: 250 OK
-
-
S: RCPT TO:<eric@mydomain.com>
-
R: 552 Recipient storage full, try again in another transaction
-
"550 No such user here" = user not on exchange server
"250 OK" = user exists
Be careful though, because you could get something like:
"552 Recipient storage full, try again in another transaction" which is an error, but the user still exists
EDIT:
Found this....
-
-------------------------------------------------------------
-
-
Example of Verifying a User Name
-
-
Either
-
-
S: VRFY Smith
-
R: 250 Fred Smith <Smith@mydomain.com>
-
-
Or
-
-
S: VRFY Smith
-
R: 251 User not local; will forward to <Smith@otherdomain.com>
-
-
Or
-
-
S: VRFY Jones
-
R: 550 String does not match anything.
-
-
Or
-
-
S: VRFY Jones
-
R: 551 User not local; please try <Jones@otherdomain.com>
-
-
Or
-
-
S: VRFY Gourzenkyinplatz
-
R: 553 User ambiguous.
-
-
Example 3
-
-
-------------------------------------------------------------
-
-