# SMTP site links count should be retrievable

SMTP site links count should be retrievable. A Maester check for Active Directory, Sites and subnets.

Source: https://maester.dev/docs/tests/AD-CFG-23

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Sites and subnets · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-CFG-23
```

## Overview

SMTP site links are a replication transport mechanism used in AD. They’re considered rare and mostly legacy/compatibility-oriented; many modern environments rely on RPC over IP (or other supported transports) rather than SMTP.

Using SMTP replication can be less secure and more difficult to harden than standard transports, depending on network controls, email path hardening, and endpoint exposure.

Monitoring SMTP site link *count* helps detect:
- Unexpected SMTP replication configuration (often a sign of misconfiguration or old legacy settings being retained)
- Potential exposure of replication paths through email-based infrastructure

#### Control Type

**Operational**

#### Security Recommendation
- Prefer RPC/IP (or other supported modern transports) and remove unnecessary SMTP site links.
- If SMTP must remain (legacy reasons), ensure you have strong network controls, hardened mail flow paths, and strict access rules.
- Periodically review replication transport configuration and validate it matches security baselines.

#### How the Test Works
The test queries AD site link configuration entries that use SMTP as the replication transport and returns the number of such SMTP site links.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-CFG-23 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Sites and subnets |
| Area | Infrastructure hardening |
| Resource type | AdSite |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdSmtpSiteLinksCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-23.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |

</details>

## Source

- Test: [`tests/ad/config/Test.AD-CFG-23.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-23.ps1)
- Documentation: [`tests/ad/config/Test.AD-CFG-23.md`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-23.md)