threats

Directory Harvest Attack (DHA)

Updated October 16, 2026

A directory harvest attack (DHA) attempts to discover valid email recipients by submitting or testing possible addresses and observing server responses. The resulting address list can support spam and phishing. DHA concerns recipient discovery; it is different from compromising a directory service or stealing its database.

2 min. read

What do I need to know about Directory Harvest Attack (DHA)?

A burst of messages to many nonexistent recipients can indicate enumeration, but broken applications and stale lists can produce similar symptoms.
Mail infrastructure may reject invalid recipients at its edge. That reduces unnecessary downstream processing but does not eliminate all address discovery.
Catch-all mailboxes can conceal recipient validity in some situations while accepting more unwanted traffic. They are not a universal defense.
Review response patterns and sender behavior together; a single failed delivery is not sufficient evidence of an attack.

An illustrative example

A mail administrator sees hundreds of failed deliveries to small variations of employee names from a short set of sources. Before blocking an entire partner domain, the administrator checks whether a newly configured application is responsible. A clear recipient-guessing pattern supports a different response from a legitimate system using an outdated directory.

Practical checks

Review invalid-recipient trends, delivery logs, source infrastructure, and timing.
Confirm accepted domains, directory synchronization, and recipient-validation settings with the mail administrator.
Apply supported throttling and abuse controls, then monitor legitimate delivery and related phishing attempts.

Five FAQs about Directory Harvest Attack (DHA)

Is a DHA a password attack?

No. Its immediate objective is usually to identify working recipient addresses. The discovered addresses may later be used in password attacks or phishing, but those are separate activities.

How does DHA differ from scraping a website?

Scraping collects addresses from published material. DHA tests candidates against mail infrastructure. Both can create target lists, but the evidence and defensive controls differ.

Will hiding our staff directory stop DHA?

It may reduce one source of names, but predictable address formats can still be guessed. Protect the mail service and identity system rather than relying only on hiding addresses.

Should every invalid recipient attempt be blocked?

Invalid recipients should be handled by your provider’s supported mail-flow controls. Investigate unusual volumes before applying broad blocks that might disrupt legitimate senders or applications.

Does a DHA mean our Microsoft 365 directory was breached?

Not by itself. Recipient enumeration does not establish access to directory records or mailboxes. Look separately for unauthorized sign-ins, permission changes, and other evidence of compromise.