Open SMTP relays are bad. The major email providers such as Gmail and Yahoo do some sanity checks such as the following at the SMTP level to prevent spam to arrive the users' mailboxes:
$ telnet alt2.gmail-smtp-in.l.google.com 25 Trying 173.194.65.27... Connected to alt2.gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP a42si10962520eem.344 - gsmtp helo google.com 250 mx.google.com at your service mail from: 250 2.1.0 OK a42si10962520eem.344 - gsmtp rcpt to: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 a42si10962520eem.344 - gsmtp QUIT 221 2.0.0 closing connection a42si10962520eem.344 - gsmtp Connection closed by foreign host.
By trial and error, I've discovered that Gmail enforces that the messages must be in a certain format. Not to say that it's completely fool-proof, but doing so can weed out the naive spammers. It's even not trivial to spam myself. :)
Unfortunately, many SMTP servers do not checks the messages more stringent than Gmail does. Prohibiting invalid email addresses in the domain isn't good enough. What if a spammer knows the usernames of the domain? I've successfully sent a spam to myself:
[ The potentially identifiable portion has been replaced by (...). ]
$ telnet (my SMTP) 25 Trying (my SMTP's IP)... Connected to (my SMTP).com. Escape character is '^]'. 220 (my SMTP) ESMTP (some string) helo 250 (my SMTP) Hello (my IP), pleased to meet you mail from:(my username)@(my domain).com 250 2.1.0 Sender ok rcpt to:(my username)@(my domain).com 250 2.1.5 Recipient ok data 354 Enter mail, end with "." on a line by itself This is my own test email. Let's see how easy it is for spammers to send email to employees. Best Regards, me . 250 2.0.0 (some string) Message accepted for delivery 421 4.4.2 Connection timed out Connection closed by foreign host.
It's easy to prank other users in the domain by replacing the "mail from" and "rcpt to" fields accordingly then. The example above shows that it's easy to spoof emails without knowing the passwords of the "sender".
Should admin be responsible for making SMTP more secure? In addition, what are the things that SMTP can do to reduce naive spammer like me? Blocking port 25 is out of question: Some super users prefer to run their own email server.
