Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Anyone have any checklist for securing the smtp server on my web server so no one else can hack it and send spam fro it?

share|improve this question
up vote 0 down vote accepted

It depends on how you are using the server. As MikeR mentioned, if you are not using it at all, uninstall the service or disable it.

If you are using it and only need a local web server to connect, go into the server properties and under Connections, set it to only allow connections from and/or your local IP block (if multiple servers need to use it). This prevents anyone on the outside from connecting to it at all.

If people on the outside need to be able to connect for some reason, set the Relay permissions to only allow your local IP addresses and any external IP addresses that you trust to relay out. This way, if someone connects and attempts to relay they will be rejected.

It's actually very easy to lock down.

share|improve this answer

You don't mention if you are actually using the SMTP server on your IIS installation, first step if you aren't using it for any reason would be to disable SMTP completely.

Microsoft have a fairly good page on Technet that explains how to secure the SMTP Virtual Servers under IIS, the authentication, connection and relaying sections are all worth looking at.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.