Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?

share|improve this question
"SMTP" as in (which do not implement the real SMTP protocol), or the real SMTP servers, as found in MX records? – curiousguy Nov 25 '13 at 14:11
Can't their admins be charged for open SMTP servers? – Smit Johnth Nov 26 '13 at 7:59

Laziness mostly. Ease of configuration, it's easier for administrators to setup a central SMTP server which doesn't require authentication to send email, than one that does.

You will often see that this is also offered by ISPs to accomodate their clients more easily.

share|improve this answer

I believe you are making the following assumption:

  • The clients of SMTP servers are a finite set of physical users that can be associated with some form of identity and therefore have accounts which can be used to authenticate and authorize them.

This is only half the story.

  • Authentication can (and should) be enforced when clients are attempting to use an SMTP server in order to relay an e-mail to a user on a remote domain. The lack of authentication and recipient control mechanisms during this phase is considered bad practice and such servers are called "open relays" since they allow anyone to use them in order to relay e-mails anywhere.

  • The other half of the story is when you receive e-mails. The "sender" in this case is another SMTP server that is connecting to your SMTP server and uses it to send a message to you. Enforcing authentication during this phase would mean that every legit SMTP server on the planet would have to have an account on every other legit SMTP server on the planet, in order to be able to send e-mails to anyone. Keeping all these accounts in sync would be a major challenge and administrative overhead.

For example, not many things prevent Trudy from connecting to a mail-provider-a SMTP server and sending an e-mail to while listing as the sender. mail-provider-a has no way to verify mail-provider-b users. This is not a misconfiguration, this is how the e-mail works.

SPF records can be used in order to verify remote SMTP servers and mitigate the above attack, by making sure the sender's IP address matches the IP address specified in the SPF record for the domain that is being claimed as the e-mail origin. This is not enforced being enforced by many email providers.

This is the reason that people should use e-mail signatures.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.