I am having the worst luck with this one. I found the first half of the flag using dnsrecon. However I am having no luck finding the 2nd half of this flag. I tried enumerating for mx records and found none. I even tried attacking a few send mail ports, got no where. I’m out of ideas. Any further hints or help would be highly appreciated.