2

Open SMTP relays are bad. The major email providers such as Gmail and Yahoo do some sanity checks such as the following at the SMTP level to prevent spam to arrive the users' mailboxes:

$ telnet alt2.gmail-smtp-in.l.google.com 25
Trying 173.194.65.27...
Connected to alt2.gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP a42si10962520eem.344 - gsmtp
helo google.com
250 mx.google.com at your service
mail from:
250 2.1.0 OK a42si10962520eem.344 - gsmtp
rcpt to:
550-5.1.1 The email account that you tried to reach does not exist. Please try
550-5.1.1 double-checking the recipient's email address for typos or
550-5.1.1 unnecessary spaces. Learn more at
550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 a42si10962520eem.344 - gsmtp
QUIT
221 2.0.0 closing connection a42si10962520eem.344 - gsmtp
Connection closed by foreign host.

By trial and error, I've discovered that Gmail enforces that the messages must be in a certain format. Not to say that it's completely fool-proof, but doing so can weed out the naive spammers. It's even not trivial to spam myself. :)

Unfortunately, many SMTP servers do not checks the messages more stringent than Gmail does. Prohibiting invalid email addresses in the domain isn't good enough. What if a spammer knows the usernames of the domain? I've successfully sent a spam to myself:

[ The potentially identifiable portion has been replaced by (...). ]

$ telnet (my SMTP) 25
Trying (my SMTP's IP)...
Connected to (my SMTP).com.
Escape character is '^]'.
220 (my SMTP) ESMTP (some string)
helo 
250 (my SMTP) Hello (my IP), pleased to meet you
mail from:(my username)@(my domain).com
250 2.1.0 Sender ok
rcpt to:(my username)@(my domain).com
250 2.1.5 Recipient ok
data
354 Enter mail, end with "." on a line by itself
This is my own test email.  Let's see how easy it is for spammers to send email to employees.
Best Regards,
me
.
250 2.0.0 (some string) Message accepted for delivery
421 4.4.2 Connection timed out
Connection closed by foreign host.

It's easy to prank other users in the domain by replacing the "mail from" and "rcpt to" fields accordingly then. The example above shows that it's easy to spoof emails without knowing the passwords of the "sender".

Should admin be responsible for making SMTP more secure? In addition, what are the things that SMTP can do to reduce naive spammer like me? Blocking port 25 is out of question: Some super users prefer to run their own email server.

1 Answer 1

4

While there is absolutely no semblance of security built-in to SMTP, open relays are a known, and solved problem.

To prevent relaying, you simply set up a list on the server of valid destination domains (typically only domains for which local delivery is an option). Then unless the sender is authenticated or otherwise allowed to relay mail, then the server should reject any RCPT TO address that is not one of the allowed domains.

Again, this is a solved problem, and 100% of all popular SMTP server packages support this feature by default.

Failure to properly restrict relaying on your server will quickly get you picked up by spammers as a relay for their junk mail and then immediately blacklisted from delivering legitimate email to all major mail destinations.

NOTE THAT YOUR ISP'S MAIL SERVER IS NOT AN OPEN RELAY

You're explicitly allowed to relay mail through your ISP. In fact, if you are a residential customer, your ISP's mail server should be the only mail server to which you can connect directly on port 25. This is intentional. Your ISP knows who you, they know your personal identity which they can derive from just your IP address.

So when you send email through their server, that email is directly tied not just to your online identity, but to your "real" identity, with the name and address that they know belongs to you. At any point in the future, that email can be traced back to you.

They allow you to relay mail because they are watching what you do. And if you misuse their mail server, you can be held accountable.

2
  • I should add that I connected to my ISP's mail server while away from my home. Would it be really bad to allow anyone to connect directly to port 25?
    – user29170
    Aug 7, 2013 at 14:15
  • Typically if you're not on their network at the time, they won't allow you to relay mail unless you log in. But they can't tell if you log in unless the first allow you to connect. So that's not too uncommon.
    – tylerl
    Aug 7, 2013 at 16:54

You must log in to answer this question.