nmap smtp open relay test shows (verbose mode):

smtp-open-relay: Server is an open relay (2/16 tests)
  MAIL FROM:<antispam@[xxx.xxx.xx.xx]> -> RCPT TO:<relaytest%nmap.scanme.org@XHS5P>
  MAIL FROM:<antispam@[xxx.xxx.xx.xx]> -> RCPT TO:<"relaytest@nmap.scanme.org">
  MAIL FROM:<antispam@[xxx.xxx.xx.xx]> -> RCPT 

xxx.xxx.xx.xx being host IP

Previous tests through mxtoolbox:

MAIL FROM:<supertool@mxtoolbox.com>
250 2.1.0 supertool@mxtoolbox.com....Sender OK [703 ms]
RCPT TO:<test@mxtoolboxsmtpdiag.com>
550 5.7.1 Unable to relay for test@mxtoolboxsmtpdiag.com [696 ms]

According to mxtoolbox, my host is not an open relay smtp

My question:

  • can I consider nmap test unreliable?

In order to check, nmap results I made a few test myself using nmap output

Here's what I got:

250 XHS5P Hello [yy.yy.yyy.yyy]
MAIL FROM:<tester@bogusyyyyyw.com>
250 2.1.0 tester@bogusyyyyyw.com....Sender OK
RCPT TO:<"relaytest@nmap.scanme.org">
250 2.1.5 "relaytest@nmap.scanme.org"@XHS5P

status code 250 2.1.5 means: email has been accepted

So, nmap was right. But I still believe it was not, since perhaps it has to do with the the fact that the recipient has double quotes

Can someone help me to figure out if my host is an open relay?

thanks a lot

  • "status code 250 2.1.5 means: email has been delivered" - no. It means that recipient was accepted. At this stage of SMTP no mail is even transmitted. Jul 18 '20 at 17:24
  • so the fact that nmap says my smtp is an open relay it's actually wrong...should I add data and subject for a more in depth check?
    – t5j
    Jul 18 '20 at 17:29

nmap tests with uncommon kinds of email address specification where it explicitly tries to bypass filtering. mxtoolbox instead just checks with the common kind of address. Still, both only check the result of RCPT TO. While a failure at this stage indicates that the address is not accepted, it will still be possible to reject the mail at a later stage of SMTP too.

One can only be fully sure that this is an open relay if one is able to actually deliver a mail through the server and then receive this mail. Similar one cannot be sure that this is not an open relay if a single attempt failed - it might still work with a different address format, with a different sender or from a different IP.

Still, based on the result from nmap you better look into the configuration of the mail server to find out why it accepts these addresses. It might be fine if the mail will be rejected at a later stage but it might also indicate a problem.

  • do you suggest any tool in order to do a more in depth analysis?
    – t5j
    Jul 18 '20 at 17:33
  • 2
    @t5j: As I said, nmap already shows that there might be a problem. So you better look at the server configuration to find out why these addresses are accepted instead of doing more blackbox testing. Jul 18 '20 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.