Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My company has just switched from having our e-mail hosted through a web hosting company to hosting it ourselves.

I have been using PHP's mail function for forms on our website and because the web hosting company we use no longer hosts our e-mails I had to switch the PHP mail function smtp server to point to our company hosted smtp server.

I've successfully pointed mail sent using the php mail function to the new smtp server and everything appears to be working.

I'm a little concerned, because no username or password is required for the php mail function.

Couldn't anyone point to our server and emulate one of our e-mail addresses?

share|improve this question
    
Assuming your corporate policy doesn't prohibit you doing basic security testing: abuse.net/relay.html –  Chris S Feb 11 '11 at 20:00
add comment

2 Answers 2

up vote 5 down vote accepted

Potentially, but not necessarily.

You didn't say exactly how the PHP forms on your website work, but I'll presume that they are used to allow your website's visitors to send a message to someone in your company. Presumably, the form bundles the message up into an email for someone at your company's domain and then sends it to your mail server via SMTP.

The fact that your mail server accepts SMTP from anywhere without a username/password isn't harmful provided it only does this for messages addressed to your domain. This is how incoming mail is processed by your mail server.

It would be dangerous, however, if your mail server accepts SMTP from anywhere without a username/password in cases where the message is addressed to a different domain. That would mean your mail server is acting as a relay, which can be exploited by spammers and email forgers.

share|improve this answer
    
Yes, the forms are set to be submitted to our company e-mail addresses. Mox, thanks for the input. I changed the to address to an e-mail address that doesn't belong to our company (outside our domain) and received: SMTP server response: 550 5.4.1 Relay Access Denied. We are protected! =0 –  payling Feb 11 '11 at 20:20
add comment

I wouldn't recommend allowing an open SMTP even for emails addressed to your domain. The logic is that email spam/forgeries can be targeted at your employees by a knowledgeable hacker/ex-employee. It'll be a scare to send an email marked to "Everyone@company" from the CEO relayed through the company SMTP.

Why don't you use auth with your SMTP for those PHP forms? You could configure auth parameters in SendMail for e.g. Or limit SMTP access to that server's IP address.

share|improve this answer
1  
+1 for a good answer, even if rather late for this question. –  John Gardeniers Nov 14 '12 at 9:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.