Services / Identity & Security
Email penetration testing: mail flow as an attack surface
General penetration tests cover networks and web applications; mail flow is often left out, even though email is one of the most common entry points for attacks on companies. We test your mail infrastructure with an attacker’s methods: whether senders can be forged, whether the gateway can be bypassed and which services are reachable from outside.
- Penetration Testing
- Spoofing
- SPF/DKIM/DMARC
- Gateway Bypass
- Exchange
- Microsoft 365
Test areas
Scope and mandate
Every test starts with a written mandate: scope, time window, contacts and excluded systems are defined in advance. Only systems the client is entitled to authorize are tested; for tests against Microsoft 365, Microsoft’s Rules of Engagement for penetration testing in the cloud apply in addition. Phishing simulations against employees are not part of the standard scope and are carried out only after agreement with those responsible for HR and data protection.
How an engagement runs
- 1 Mandate and scope Define objectives, systems, time window and emergency contact in writing.
- 2 Reconnaissance Evaluate publicly visible information: DNS, MX, certificates, exposed services.
- 3 Testing Within the agreed time window, every step logged and traceable.
- 4 Report and retest Findings prioritized by risk, with concrete measures; after implementation, a retest of the critical points.
Further reading
Check it yourself
Planning something similar?
In a first conversation, we'll look at where you stand, the risks and the most sensible next step.