Is it acceptable to enable relay of emails in an internal email server in a corporate network?

Question

I know that SMTP is inherently vulnerable to a lot of issues and if not properly configured, an SMTP server can be used to relay emails which originate from and destined to third-party domains.

What I understand from open mail relay is unauthenticated relay of emails. Correct me if I am wrong. Is there any good reason why unauthenticated relay should be allowed inside a corporate network?

Is it considered vulnerable if the following POC results in an email in my inbox?

telnet internalmailserver.mydomain.com 25
220 Ironportblabla.mydomain.com ESMTP
HELO
250 Ironportblabla.mydomain.com
MAIL FROM:[email protected]
250 sender <[email protected]> ok
RCPT TO:[email protected]
250 recipient <[email protected]> ok
DATA
354 go ahead
TEST
.
250 ok: Message 123456 accepted

1. The above method can be used by an internal adversary to spoof and send emails to any internal employee as anyone else. Isn't this vulnerable?
2. Is there any justified acceptable reason for allowing internal-internal and external-internal relay in internal mail servers?
3. Would stopping this affect the normal functioning of corporate email?

Answer 1

The above method can be used by an internal adversary to spoof and send emails to any internal employee as anyone else. Isn't this vulnerable?

Yes. There is a university of applied sciences in my neighborhood that had such a mail server that allowed any user to use any email address from their own domains. Someone abused it to send around personalized but automated love letters. It was hilarious. The IT department, instead of being in shame after having been pointed to that vulnerability multiple times, went after the person. It was hilarious.

Is there any justified acceptable reason for allowing internal-internal and external-internal relay in internal mail servers?

You often have an outgoing mail server that your internal mail server contacts for all mails that it cannot deliver locally. These two are often running on the same machine, and it's acceptable to open the mail server port only locally to allow the internal, and only the internal mail server, to directly talk to the outgoing server. The internal server then has the duty of making sure only authorized users can send mail from addresses that belong to them.

Would stopping this affect the normal functioning of corporate email?

No, because this isn't normal.