Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a dedicated server on 1&1 and I manage it with Plesk. The problem is that if I try to send a mail outside the server, I must to authenticate with the email and the password, but if I send an email to a address inside of my server I don't need neither email or password. This is a problem because the spammers are sending mails without any problem to the server accounts. We are receiving about 900 - 1200 emails everyday! What can I do?

I use qmail on CentOS


share|improve this question

that doesn't sound like an open relay to me.

as you said, to send mail from a host not local to the machine, you need to authenticate.

if you're /on/ the server, you can send mail without authentication, which is the way it is typically done.

if your server is /sending/ massive amounts of spam, then yes, you have a problem, and you need to post more details so we can help.

otherwise, it sounds, from your question, like you're receiving spam (and 900-1200 spam a day is LOW), and that's just the internet for you.

you can look into installing and configuring anti-spam services like spamassassin to help control the spam delivered to mailboxes on your server, and you can use black lists like to prevent some spam from being accepted.

share|improve this answer a qmail anti-spam guide... – cpbills May 14 '10 at 16:52

Well Jonathan,

Sorry to tell you, but this is the correct behavior. A relay means your server relays emails to other servers. You're not running an open relay because clients must authenticate to relay email out. You need to accept anonymous connections to send email to local users. That's how email works and it's one of those design decisions that made spamming so easy. What you really should do is deploy a spam filter like spamassassin on your server. That'll remove much of what comes in. You might also want to use DNS Blacklists, but choose a lenient one or you'll have a lot of false positives.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.