Forum Moderators: phranque
telnet mailserver.ip.address 25
will tell you some information.
Exchange, Lotus, MailDaemon and most will introduce themselves by default.
Some don't or are configured not to for fear of abuse.
A handful of mail servers are known to accept mails from anyone that claims as admin@domain.of.mailserver without authentication.
By revealing their mail server software also reveals their version and available exploits to "potential" hackers.