Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.
Last login: Wed Jun 22 14:02:11 on ttys001
BASH$ telnet domain.com 25
Trying xxx.xx.xxx.xxx...
Connected to domain.com.
Escape character is '^]'.
220 hostname.com ESMTP
helo
250 hostname.com
mail from: <danayoub53@gmail.com>
250 ok
rcpt to: <anyone@gmail.com>
553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)
rcpt to: <registration@domain.com>
250 ok  ***********<---------------------- OK??!?

As you can see, qmail blocks the attempt to send mail to an outside address, however has no problem allowing an un-authenticated user to send mail to local addresses residing on the server. This could pose problems if someone wanted to send viruses, or clog e-mail accounts on the server.

Can anyone recommend a fix for this? Am I correct in point out that this is a bug?

Best, Daniel

share|improve this question

migrated from stackoverflow.com Jun 23 '11 at 1:52

This question came from our site for professional and enthusiast programmers.

2 Answers 2

SMTP has never required people to authenticate before sending email to accounts on the local machine. It is not a bug at all. How else would an SMTP server receive email to be delivered to the domains you are hosting email for?

share|improve this answer

As X-Istence says, the question is fundamentally bogus. There is no such thing as relay to a locally hosted mailbox. It's a conceptual error. Either the mailbox is remote, in which case the mail has to be stored and forwarded — i.e. relayed — to it, or the mailbox is local, in which case there is no relaying going on at all because the system is the final destination for the mail.

rcpthosts, which defines which domains the SMTP Relay server (qmail-smtpd) will accept in envelope recipient mailboxes, is (usually) the union of all locally hosted domains and all domains for which mail is permitted to be relayed. That it has allowed a message from the outside world to be addressed to a locally hosted mailbox isn't an error. It's working as designed. If you do not want the outside world to be able to send mail to you, do not run an SMTP Relay server. Running an SMTP Relay server implies that you do want the outside world to be able to send mail to you.

The notion of authorization applies, obviously enough, to local users that you have a user database for, and thus applies to SMTP Submission, not to SMTP Relay. If you've been confused by the Old-Fashioned Mail Injection Protocol into thinking that SMTP Relay deals in authorization (when, of course, there's no way for you to have a user database listing the arbitrary people in South Africa or India or France who might want to send mail to you) then you need to re-familiarize yourself with the difference between SMTP Submission and SMTP Relay. This is the 21st century; we know about service separation nowadays; we shouldn't be using the OFMIP paradigm any more.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.