I have a Small Business Server 2003 (Exchange 2003 SP2). During a PCI Compliance audit, it was flagged as failing the open relay. I've used telnet to test, and here is what I've found:
MAIL FROM: <firstname.lastname@example.org> 250 2.1.0 email@example.com....Sender OK RCPT TO: <"firstname.lastname@example.org"> 250 2.1.5 "email@example.com"@mydomain.com
The relay is failing whenever the address is malformed. The server always returns a 250 status, but also always adds my domain name to the end of the address.
I have the server configured to only relay for an internal ip address configured on an IIS site's error reporting module.
Testing with a valid email address (but malformed with quotes and angle brackets) resulted in no mail received. Is there a way to exploit this, and if so, how do I disable this?