Use mslookup to find the mta:
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Phillip.Hutchings>nslookup /?
Usage:
nslookup [-opt ...] # interactive mode using default server
nslookup [-opt ...] - server # interactive mode using 'server'
nslookup [-opt ...] host # just look up 'host' using default server
nslookup [-opt ...] host server # just look up 'host' using 'server'
C:\Users\Phillip.Hutchings>nslookup
Default Server: UnKnown
Address: 172.22.105.51
> somesite.co.nz
Server: UnKnown
Address: 172.22.105.51
Name: somesite.co.nz
Address: 202.74.207.16
> somesite.co.nz MX
*** Can't find address for server MX: Non-existent domain
> ?
Commands: (identifiers are shown in uppercase, [] means optional)
NAME - print info about the host/domain NAME using default server
NAME1 NAME2 - as above, but use NAME2 as server
help or ? - print info on common commands
set OPTION - set an option
all - print options, current server and host
[no]debug - print debugging information
[no]d2 - print exhaustive debugging information
[no]defname - append domain name to each query
[no]recurse - ask for recursive answer to query
[no]search - use domain search list
[no]vc - always use a virtual circuit
domain=NAME - set default domain name to NAME
srchlist=N1[/N2/.../N6] - set domain to N1 and search list to N1,N2, etc.
root=NAME - set root server to NAME
retry=X - set number of retries to X
timeout=X - set initial time-out interval to X seconds
type=X - set query type (ex. A,AAAA,A+AAAA,ANY,CNAME,MX,NS,PTR,
SOA,SRV)
querytype=X - same as type
class=X - set query class (ex. IN (Internet), ANY)
[no]msxfr - use MS fast zone transfer
ixfrver=X - current version to use in IXFR transfer request
server NAME - set default server to NAME, using current default server
lserver NAME - set default server to NAME, using initial server
root - set current default server to the root
ls [opt] DOMAIN [> FILE] - list addresses in DOMAIN (optional: output to FILE)
-a - list canonical names and aliases
-d - list all records
-t TYPE - list records of the given RFC record type (ex. A,CNAME,MX,NS,
PTR etc.)
view FILE - sort an 'ls' output file and view it with pg
exit - exit the program
> set type=MX
> somesite.co.nz
Server: UnKnown
Address: 172.22.105.51
somesite.co.nz MX preference = 5, mail exchanger = mta.somesite.co.nz
somesite.co.nz nameserver = ns2.somesite.co.nz
somesite.co.nz nameserver = ns1.somesite.co.nz
mta.somesite.co.nz internet address = 202.74.207.110 ns1.somesite.co.nz internet address = 202.74.207.10 ns2.somesite.co.nz internet address = 202.74.207.100
>
once that is found, telnet in (telnet mta.somesite.co.nz 25) and verify the username to see if it exists or not:
220 MTA1.somesite.co.nz SMTP Server ( Exim )
VRFY suspect@somesite.co.nz
252 Administrative prohibition
MAIL FROM: <sky@xero.com>
250 OK
RCPT TO: <suspect@somesite.co.nz>
550 Unrouteable address