Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have noticed the mail server we use at work (provided by our web-host) doesn't require any authentication to send mail through.

I understand you easily spoof sender address' in emails, but I'm wondering what the consequences of not having authentication on a SMTP server?

The glaring one I see is that someone could send mail as a staff member or exec through that employees actual account without any kind of spoofing - is this worse than spoofing itself? Or would spoofing get the same reqult and thus there is no point trying to secure the server?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

The security consequences of this server to you are likely negligible. Sending spoofed email is trivial no matter what you do. Even if you lock down or turn off this server, it will still be simple for anyone to send a spoofed email with a spoofed From: address. You can't stop it by tightening up this server, since attackers are free to send their email through any SMTP server you want, and there are too many other open relays in the world to stop this.

The consequences to the rest of the world are that you are arguably contributing, by a tiny amount, to the ease of spam. You are running an open relay. Open relays let any spammer send spam with a spoofed From: address. For these reasons, open relays are considered a bit anti-social and generally frowned upon.

It's a bit like polluting: if you pollute just a little bit, the risk to your own health may be minor, but if everyone did that, our skies would be a horrid haze of pollutants, and everyone would suffer. Therefore, for everyone's sake, the right thing to do is to avoid running an open relay.

The biggest risk to you is that spam-fighters may detect that your SMTP server is acting as an open relay and blacklist your server as a result. This could cause email you send to others to be marked as spam by the recipient email system. For these reasons, you probably don't want to keep your SMTP server available as an open relay.

You can test whether your mail server is configured as an open relay using any number of online testers.


I'm not sure what you mean when you talk about sending an email through this server without any kind of actual spoofing. I'm not sure what distinction you are drawing. Connecting to a mail server, pretending to be Alice, and asking it to send email from Alice is exactly spoofing. In other words, what you're talking about is exactly how email spoofing is done.

share|improve this answer
1  
Note that it might not be an open relay even if it does not require authentication: in some mail set-ups, there is a dedicated SMTP server for sending outbound mail only, which is firewalled so that only intranet hosts can use it. –  Graham Hill Aug 1 '12 at 8:21
    
thanks very much for the answer! - what I meant the last paragraph was: is there a difference if you send the mail as alice@abc.com through mail.abc.com compared to sending it through someotherrelay.com - but I realize your answer covers that! –  OrangeBox Aug 2 '12 at 3:36
    
@OrangeBox, in principle there is one difference: a recipient who looks at the headers can recognize that email from alice@abc.com that traverses someunrelatedrelay.com is more likely to be a forgery, whereas that hint is not available if the mail was sent through mail.abc.com. However, I don't know how significant this difference will be in practice (most users don't look at the headers, and I don't know if there's any other way this would be noticed). –  D.W. Aug 2 '12 at 4:08
    
thanks for the info! –  OrangeBox Aug 6 '12 at 5:05

Generally speaking all mail servers allow other servers to connect and send e-mails in. Spoofing a "from addresses" is no different than putting a fake return address on an envelope and putting it in the mail.

However checking the to: address is far more important. An open relay is a mail server that doesn't care who the intended recipient is, it just relays the mail on even if it is not destined for a mailbox it services. A properly secured mail server will at the very least require some type of authentication if the "to:" address is outside it's realm, it should also check that the "from:" address matches the account being used to authenticate the outbound mail.

When the mail is inbound most servers don't check the "from:" address which can lead to some interesting issues, such as: from: person1@mycompany.com to: person2@mycompany.com A lot of mail servers will send this message on to person2@mycompany.com without ever asking for any authentication. The reason being, most times if an e-mail is coming in from an external source the "from:" address wouldn't be from inside and so it wouldn't have an account to use for authentication anyway.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.