Why adjust SMTP settings during a pentest?

During a pentest we ask you to temporarily change your application's SMTP settings to an SMTP server provided by DongIT. This allows our pentesters to view all emails your application sends, which is essential for a complete assessment of authentication flows and business logic.

What are SMTP settings?

SMTP (Simple Mail Transfer Protocol) is the protocol applications use to send emails. Settings usually consist of an SMTP server (host), port, username and password. By using our SMTP server during the pentest, all outgoing emails are routed to us without actually reaching the intended recipient.

Why we ask for this change

Emails from your application often contain security-sensitive information that only becomes visible during active user flows. Our pentesters test these flows and must be able to verify actual email content. Concrete examples:

• Password reset emails. Contain reset tokens whose strength and predictability must be tested.
• Account activation emails. May contain weak confirmation tokens or unintended information leaks.
• Multi-factor authentication codes. Verification of MFA flow (lifetime, reuse, rate-limiting on sending requests).
• Backend notifications. Internal emails that may leak to external users through injection or misconfiguration.
• Confirmation emails. For orders, payments or contract transactions, where business logic flaws or privilege escalation can become visible.
• Bulk mailings. For detecting bulk sending endpoints that can be abused for spam or phishing.

Without access to these emails, pentesters must guess at the content or do extra work to verify via other channels, which reduces core testing time.

How to change SMTP settings

In most development frameworks this is a central configuration change:

• Laravel. Adjust in config/mail.php or .env file.
• Django. EMAIL_HOST, EMAIL_PORT and credentials in settings.py.
• Spring Boot. spring.mail.host and spring.mail.port in application.properties.
• .NET. SMTP section in appsettings.json or web.config.
• Node.js (Nodemailer). Adjust transport configuration in the mailing module.
• WordPress. Via plugins such as WP Mail SMTP or directly in wp-config.php.

Our DevOps team can support with setup. At the start of the pentest you receive the exact SMTP details (host, port, credentials) from us.

Alternatives if changing SMTP is not possible

For applications that send email via an API (for example Mailgun, SendGrid, Postmark, Amazon SES) or where SMTP change is not practical, we offer these alternatives:

• Email forwarding. Forward all outgoing emails to an email address that we provide.
• BCC configuration. BCC all outgoing emails to a DongIT email address during the test period.
• Use test endpoint. For API services such as Mailgun or SendGrid: use their sandbox or test mode.
• Log-based inspection. Your application logs all outgoing emails completely so pentesters can review them via logs.

The right option depends on your architecture. This is discussed during the scoping conversation.

Is it required?

No, changing SMTP settings is recommended but not required. Without this change we can still pentest, but with limitations:

• Loss of visibility into background emails
• Limited verification of password reset and MFA flows
• More indirect test methods needed, which are more time-consuming
• Blind spots in the report for email-related findings

Learn more about pentest preparation? See the FAQ on how you prepare for a pentest. Contact us for a complimentary scoping conversation, or view our pentest packages.