EXPN

What it means

EXPN works like VRFY but for lists: given the list name, a server that allows it returns the member addresses, one per line. RFC 5321 records that EXPN came to be used to harvest addresses for spam once lists were protected in other ways. It still asks implementations to support the command but tells sites to weigh the trade-off, suggesting it be offered only to authenticated users, for example to audit how mail is routed inside an organisation.

A site that disables EXPN for security reasons must answer 252 rather than a reply that could pass for a real result. A sender should never expect EXPN to work against another organisation's servers.