What is or are the best methods to id a email server type and version?

The only two methods I know of are the obvious ones:

Connecting to the server directly and getting info from the network banner (which can be changed) or by analysing an e-mail header from that server!

Sorry about vagueness, or stating the obvious, but I cant think of any other methods!

Yes, I'm hoping for a more modern/accurate techique. I was aware of the older and less reliable methods.

You can check for Microsoft Exchange by looking for OWA.

www.hostname.com/exchange

Some times you can look for virus software which will generate clues.

www.hostname.com/interscan


You can also send mail that will purposely bounce and look for clues.

You can use the help command after telnetting to port 25 and look for the commands allowed and anything that may unquely identify the server. Use the output to compare to known mail server products.

You can run ethereal and capture your communication with the mail server and look for clues.

Once in awhile on the high ports you may find web based mail which will give you an idea what is running at port 25.