smtp.open_relay

Open Relay Detected

What we check

We attempt to relay a message through the server to a recipient at a domain the server does not host. A properly configured mail server refuses this — it only accepts mail for its own domains or from authenticated users. This finding is emitted when the server accepted the relay attempt without authentication.

What this finding means

The server accepted a mail relay request from an unauthenticated external sender to an external recipient. This means anyone on the internet can use this server to send email to arbitrary destinations — it is an open relay.

Why it matters

Abuse magnet. Open relays are immediately discovered and exploited by spammers. Once abuse begins, the server's IP addresses land on public blocklists (Spamhaus, Barracuda, etc.), causing all legitimate mail from those IPs to be rejected by major providers.
Reputation damage. Blocklist removal is slow and manual. During that time, the domain's legitimate email — invoices, customer communication, password resets — may bounce or go to junk.
Legal exposure. In some jurisdictions, operating an open relay that is used for spam distribution can create legal liability for the operator.
Resource consumption. Spammers sending millions of messages through the relay consume bandwidth, CPU, and storage, and may trigger abuse complaints from the hosting provider.

How to fix

Restrict relay access. For Postfix, ensure that mynetworks lists only your own IP ranges and that smtpd_relay_restrictions requires authentication for external destinations:
```
# /etc/postfix/main.cf
smtpd_relay_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination
```

Verify the fix:

# From an external host, attempt to relay:
telnet mail.example.com 25
EHLO test.example.net
MAIL FROM:<test@example.net>
RCPT TO:<test@example.org>
# Expected: 554 5.7.1 Relay access denied

Check for authentication bypasses. Ensure no firewall rule, Docker network, or VPN range inadvertently appears in mynetworks, which would grant relay privileges without authentication.

How it's graded

An open relay triggers an instant F grade — a 100-point penalty that overrides all other scores. No other finding carries this weight. An open relay is a critical security misconfiguration that requires immediate remediation. See Grading Methodology for the full scoring model.

Evidence example

S: 220 mail.example.com ESMTP
C: EHLO scanner.example.net
S: 250-mail.example.com
S: 250 ENHANCEDSTATUSCODES
C: MAIL FROM:<probe@example.net>
S: 250 2.1.0 Ok
C: RCPT TO:<probe@example.org>
S: 250 2.1.5 Ok              ← relay accepted without authentication

References

RFC 5321 — Simple Mail Transfer Protocol