How to auto detect a remote IMAP/POP3 server knowing only an email

I would like to auto-detect a hosts (e.g. example.com) IMAP/POP3
server
(e.g. imap.example.com) knowing only someones email address (e.g.
b...@example.com).

Since there isn't a required DNS record to indicate the IMAP/POP3
server
name, unlike SMTP with has an "MX" record, how might I go about auto-
detecting the hostname of the IMAP/POP3 server knowing only someone's
e-
mail address?

Thanks in advance.

Re: How to auto detect a remote IMAP/POP3 server knowing only an email address ?

mp- wrote:

>I would like to auto-detect a hosts (e.g. example.com) IMAP/POP3
>server (e.g. imap.example.com) knowing only someones email
>address (e.g. b...@example.com).

Why would you want to find someone's POP3 server if the only thing you
know about them is their email address? Do you have any reason to
access their POP3 server? Does knowing their POP3 server name help you
process mail in any way?

>Since there isn't a required DNS record to indicate the IMAP/POP3
>server name, unlike SMTP with has an "MX" record, how might I
>go about auto-detecting the hostname of the IMAP/POP3 server
>knowing only someone's e-mail address?

Generally speaking, there is no need to have a DNS record indicating
where to find someone's POP3 server since no-one in the outside world
needs to know that information, only the owner of the domain name, and
either they know it already, so no need to put it in the DNS, or they
don't know it, in which case they cannot put it in the DNS.

The only two legitimate cases I could think of where a third party
might need to know the POP3 address are:

1) Configuration utilities for email programs
2) Generic web interfaces to POP3

There may be other reasons, but off-hand I cannot think of what they
could be.

In both the above cases, it would be simple enough to loop through the
most likely names, e.g. example.com, pop3.example.com,
mail.example.com, testing port 110 and seeing if there is a POP3
server responding. But if you were writing software for either of the
above cases then you'd already know all about that.

This method certainly isn't foolproof since there is no guarantee that
the system you are probing is configured to use a common name, or that
it is using port 110. It is also possible that the system is protected
by a firewall which regards these probes as abusive and blocks off
further access.