Enumerate users. If -M VRFY is not working, try other mode like RCPT

smtp-user-enum -M VRFY -U ./user.list -D domain.name -t $target -p 25 -w 15