Email penetration testing: mail flow as an attack surface
General penetration tests cover networks and web applications; mail flow is often left out, even though email is one of the most common entry points for attacks on companies. I test your mail infrastructure with an attacker’s methods: whether senders can be forged, whether the gateway can be bypassed and which services are reachable from outside.
- Penetration Testing
- Spoofing
- SPF/DKIM/DMARC
- Gateway Bypass
- Exchange
- Microsoft 365
Test areas
- Spoofing and authenticationCan your domain be forged from outside? SPF, DKIM and DMARC are tested against real recipients, including subdomains and lookalike domains.
- Gateway bypassDirect delivery to Exchange Online or the mail server, bypassing the upstream gateway, Direct Send, insufficiently secured connectors and relays.
- Reachable servicesSMTP, OWA, EWS, ActiveSync, Autodiscover and gateway admin interfaces: versions, known vulnerabilities, TLS configuration and authentication methods.
- Filtering and deliveryHow the gateway handles crafted attachments, links and headers, tested with harmless test patterns instead of real malware.
- Mailbox security in Microsoft 365Legacy authentication, external forwarding, app consents and audit configuration as a configuration review.
Scope and mandate
Every test starts with a written mandate: scope, time window, contacts and excluded systems are defined in advance. Only systems the client is entitled to authorize are tested; for tests against Microsoft 365, Microsoft’s Rules of Engagement for penetration testing in the cloud apply in addition. Phishing simulations against employees are not part of the standard scope and are carried out only after agreement with those responsible for HR and data protection.
How an engagement runs
- Mandate and scopeDefine objectives, systems, time window and emergency contact in writing.
- ReconnaissanceEvaluate publicly visible information: DNS, MX, certificates, exposed services.
- TestingWithin the agreed time window, every step logged and traceable.
- Report and retestFindings prioritized by risk, with concrete measures; after implementation, a retest of the critical points.
Real-world examples
- Ghost Sender in Exchange Online: how mail bypasses the gateway and lands directly in the tenant.
- Sending mail through a relay: checking TLS and authentication: the test steps for relays and submission points.
- CVE-2026-62911: Exchange NTLM relay: why many on-premises Exchange servers are vulnerable.
- Mail DNS Check: self-test of MX, SPF, DKIM and DMARC in advance.
