Issues with using a mail server that doesn't support authentication to send mail?

Question

I have noticed the mail server we use at work (provided by our web-host) doesn't require any authentication to send mail through.

I understand you easily spoof sender address' in emails, but I'm wondering what the consequences of not having authentication on a SMTP server?

The glaring one I see is that someone could send mail as a staff member or exec through that employees actual account without any kind of spoofing - is this worse than spoofing itself? Or would spoofing get the same reqult and thus there is no point trying to secure the server?

Answer 1

The security consequences of this server to you are likely negligible. Sending spoofed email is trivial no matter what you do. Even if you lock down or turn off this server, it will still be simple for anyone to send a spoofed email with a spoofed From: address. You can't stop it by tightening up this server, since attackers are free to send their email through any SMTP server you want, and there are too many other open relays in the world to stop this.

The consequences to the rest of the world are that you are arguably contributing, by a tiny amount, to the ease of spam. You are running an open relay. Open relays let any spammer send spam with a spoofed From: address. For these reasons, open relays are considered a bit anti-social and generally frowned upon.

It's a bit like polluting: if you pollute just a little bit, the risk to your own health may be minor, but if everyone did that, our skies would be a horrid haze of pollutants, and everyone would suffer. Therefore, for everyone's sake, the right thing to do is to avoid running an open relay.

The biggest risk to you is that spam-fighters may detect that your SMTP server is acting as an open relay and blacklist your server as a result. This could cause email you send to others to be marked as spam by the recipient email system. For these reasons, you probably don't want to keep your SMTP server available as an open relay.

You can test whether your mail server is configured as an open relay using any number of online testers.

---

I'm not sure what you mean when you talk about sending an email through this server without any kind of actual spoofing. I'm not sure what distinction you are drawing. Connecting to a mail server, pretending to be Alice, and asking it to send email from Alice is exactly spoofing. In other words, what you're talking about is exactly how email spoofing is done.

Answer 2

Generally speaking all mail servers allow other servers to connect and send e-mails in. Spoofing a "from addresses" is no different than putting a fake return address on an envelope and putting it in the mail.

However checking the to: address is far more important. An open relay is a mail server that doesn't care who the intended recipient is, it just relays the mail on even if it is not destined for a mailbox it services. A properly secured mail server will at the very least require some type of authentication if the "to:" address is outside it's realm, it should also check that the "from:" address matches the account being used to authenticate the outbound mail.

When the mail is inbound most servers don't check the "from:" address which can lead to some interesting issues, such as: from: person1@mycompany.com to: person2@mycompany.com A lot of mail servers will send this message on to person2@mycompany.com without ever asking for any authentication. The reason being, most times if an e-mail is coming in from an external source the "from:" address wouldn't be from inside and so it wouldn't have an account to use for authentication anyway.