Curious as to the current results, I've continued a SMTP software survey
project that djb had been running during 1996 though 2001
(http://cr.yp.to/surveys.html).

my signatures are largely based on DJB's provided signatures of the
20011003 survey.  I made effort to ensure the correctness of my
signatures, but wouldnt be surprised if I missed some (ultimately
putting the software in the 'unknown' category).

you can download my code, inspect it, and/or run it:
http://jeremy.kister.net/code/smtp_survey/

the code is very primitive, not written to be neat or orderly, but
simply functional.

also to note: I received 4 abuse complaints for attempting to connect to
an IP Address on port 25.
1 from: a2toc@us.army.mil
3 from: updatestatusonly@mynetwatchman.com


the results of my 20050408 test are as follows:

out of 1 million IP Address:
5734 accepted a socket on port 25
3163 gave a 220 in the banner
2856 gave a 250 for HELO
2613 gave a 250 for EHLO
3045 gave a 250 for MAIL FROM

Total SMTP Software:
sendmail  => 1874 (62%)
microsoft  => 275 (9%)
qmail  => 180 (6%)
exim  => 142 (5%)
imail  => 90
smap  => 62
postfix  => 52
unknown (HINES)  => 37
checkpoint  => 34
mailenable  => 17
unknown (*****)  => 17
mdaemon  => 14
merak  => 9
dmail  => 8
xmail  => 7
lotusdomino  => 7
argosoft  => 7
ntmail  => 5
mailfront  => 5
interscan  => 5
mailsite  => 4
webshield  => 3
spa  => 3
groupwise  => 3
stalker  => 2
powermta  => 2
netscape  => 2
messagewall  => 2
mailmax  => 2
kerio  => 2
firstclass  => 2
winroute  => 1
raptor  => 1
postoffice  => 1
os400  => 1
ims  => 1
ftgate  => 1
unknown  => 165

of the 180 qmail installations found, 17 were Critical path, 19 were netqmail.