Protection AgainstDirectory HarvestAttacks
In a Directory Harvest Attack, an attacker systematically tries addresses against the mail server to uncover valid mailboxes. Conbool MailGuard detects this pattern, throttles the attack and prevents the server from revealing which addresses exist in the first place.
Valid email addresses are the currency for spam and targeted phishing. Directory harvesting is the way to obtain these addresses, long before the first malicious message arrives.
The attack abuses the normal behavior of mail servers. Anyone who targets a non-existent address receives an error message. Anyone who hits a valid address does not. Attackers build a list of real mailboxes from exactly this difference. Effective protection begins by making this difference invisible.
What a Directory Harvest Attack Is
A Directory Harvest Attack, also known as DHA and as a directory attack, is the attempt to determine the valid addresses of a domain. To do this, delivery attempts are sent on a large scale to guessed addresses, for example to common first names, initials combined with surnames or entire alphanumeric sequences. From the server's responses, the attacker deduces which addresses actually exist and fills spam and phishing databases with them.
How a Directory Attack Unfolds
Four phases from the first probe to a finished address list.
Guess addresses
The attacker generates large quantities of likely addresses from name lists, initials and fixed patterns.
Probe the server
A delivery attempt goes to each guessed address. Often spread across many source addresses to avoid attracting attention.
Evaluate responses
A rejection means the address does not exist. An acceptance or another reaction reveals a valid mailbox.
Exploit the list
The confirmed addresses move into spam and phishing campaigns or are resold.
Why Directory Harvesting Is Dangerous
The attack itself steals no data, it prepares the actual damage.
Spam and phishing target
Confirmed addresses are deliberately bombarded with malicious messages. Real mailboxes receive significantly more attack attempts.
Load on the mail server
Mass delivery attempts tie up resources and can slow the acceptance of legitimate messages.
Risk to reputation
Uncontrolled error messages and bounces can impair your own deliverability.
Data protection relevance
A harvested list of valid mailboxes is a collection of personal data and a building block for targeted attacks.
How Conbool MailGuard Protects
MailGuard removes the basis of the attack: the telltale difference between a valid and an invalid address.
Pattern detection
Conspicuous series of delivery attempts to many different addresses are recognized as harvesting and work together with the reputation assessment.
Throttling
Suspicious sources are deliberately slowed down so that probing is no longer possible within a reasonable time.
Uniform responses
Valid and invalid addresses are treated identically in the event of an attack, so the server does not reveal which mailboxes exist.
Recipient verification
Only addresses that actually exist are accepted, without disclosing the existence of individual mailboxes.
Reputation and greylisting
Known attack sources and inconspicuously distributed campaigns are slowed down through reputation and delayed acceptance.
Traceable logs
Detected attacks are documented and available for analysis and audits, without hindering legitimate delivery.
Frequently Asked Questions About Directory Harvesting
What is a Directory Harvest Attack?
How does DHA differ from spam?
Why is a classic spam filter not enough?
Does the protection prevent legitimate senders from being rejected?
Does directory harvesting matter for data protection?
Does MailGuard protect even without rebuilding the existing mail servers?
Further Building Blocks of Email Security
MTA-STS
Enforced TLS encryption for email transport.
DANE and TLSA
Cryptographically anchored certificate binding, mandatory under BSI TR-03108.
TLS-RPT
Reports on transport errors for complete visibility.
MailGuard
The email security gateway that bundles transport and content protection with harvesting defense.
Protect Addresses Before the Wave of Spam Arrives
Conbool MailGuard detects directory harvesting and removes the basis of the attack. A conversation shows how protection can be set up for your own environment.