This question title might seem a little vague, and I apologize for that. Let me just begin by stating I'm an engineering psychologist—not an IT security or computer guru by trade. As luck would have it, my employer (a very, very big one) has placed me on a small team where I work on a mission critical server that can (ideally) never fail and has to have the utmost security. I do web design, accessibility analysis, user experience stuff — all front-end. Without really thinking about it and without any regard to my skills or background, someone up the chain unwittingly placed me in charge of also making sure the entire system is secure, as at one point our website was listed on senderbase.org with a poor reputation rating.
One of my co-workers seems to think that unix's Sendmail is the root of the problem. Concordantly, we blocked all traffic on port 25 and stopped running sendmail. But because of that, my contact forms using php mail() don't work (requires sendmail). I was told that "there is no way to use SMTP on a server and have a secure server." But I'm less certain of this.
On a clean, uninfected system with ideal security, could sendmail be targeted from the outside and used to send spam email? In other words, are there any secure ways to send emails server side? Or will I have to convert all my contact forms to "mailto:" links, etc?
To be clear: the location of the mail is to a support email we use. It is hardcoded; all email gets sent to this email address and the user cannot change this (unless there are hacking techniques I'm unaware of, which is really my question). The only fields the user can type in are Subject, Message, and From.
There obviously has to be some solution because I see email contact forms all the time on huge, powerful websites. If it was a security weakness, you'd think google, yahoo, facebook, cnn, times, and all those other popular websites would have stopped using it long ago, right?
