What is a directory harvest attack (DHA)?

A directory harvest attack (DHA) is a technique in which a spammer sends a burst of SMTP RCPT TO commands for guessed addresses at a target domain, such as common first names and name patterns, and records which ones the server accepts. Accepted addresses are added to spam lists and sold. The attack works only against servers that reveal whether a recipient exists, or that accept everything and bounce later.

What the attacker sees

C: RCPT TO:<amit@example.com>
S: 250 2.1.5 OK
C: RCPT TO:<amita@example.com>
S: 550 5.1.1 User unknown
C: RCPT TO:<anil@example.com>
S: 250 2.1.5 OK

Two valid addresses harvested in three tries. A single session can test thousands of guesses.

The two bad responses

Accept everything. Some gateways accept every recipient and let the mail store bounce unknown ones later. This gives the harvester no information during the session, but it creates backscatter: the bounces go to the forged envelope sender, which is an innocent third party. Backscatter gets the gateway’s IP onto blocklists.

Answer honestly with no limits. The server tells the truth about each address, and the attacker walks the whole namespace at wire speed.

The right response

Validate recipients live against the directory, reject unknown ones at RCPT TO (which avoids backscatter), and count invalid recipients per connecting IP. After a small number of unknown recipients in a short window, refuse the connection or slow it to a crawl. Legitimate senders almost never hit more than one or two invalid addresses in a session; a harvester hits dozens in seconds.

Greylisting and DNSBL checks at connection time remove most harvesting traffic before it reaches RCPT TO at all.

In Spamjadoo

Spamjadoo validates every recipient against the customer’s directory, LDAP, SQL or an SMTP callout, and applies a per-IP invalid-recipient threshold at RCPT TO. Harvesting sessions are cut off after a handful of guesses, and because nothing is accepted then bounced, the deployment never generates backscatter. See how it works.

Last reviewed 10 September 2026 by Spamjadoo engineering.