I noticed that I am able to send emails from my company's mail server to internal receivers from faked inhouse sender addresses without problem and I'm wondering if this should be supposed a security issue or not.
I wrote a little python script to connect to the server and send a mail from personA@company.com to personB@company.com and that mail was delivered without any problems. Sometimes it was marked as spam, sometimes not. After a few e-mails, the sending server got blocked because of poor reputation. So my question is: Is this really expected behaviour?
I would expect that such a setup is ideal for sending phishing or spamming mails to employees of that particular organization. Of course, I do understand that you should be able to connect to an smtp server from outside to send mails to local receivers, otherwise no mails could be delivered. But is it really common that there is no kind of verification of the sender address or that it is so weak?
A member of the IT-Department didn't seem suprised when I talked to him about that issue and told me that this was quite normal behaviour. This post suggests that he is right: Issues with using a mail server that doesn't support authentication to send mail?. So I checked if I could do the same with my (security-aware) mail-provider: The client got blocked before it could even send the mail, and client and receiver address, both my regular mail addresses, were rejected. That's what I would expect from a correctly configured server. Am I wrong here? Is it really negligible?