3

My company has just switched from having our e-mail hosted through a web hosting company to hosting it ourselves.

I have been using PHP's mail function for forms on our website and because the web hosting company we use no longer hosts our e-mails I had to switch the PHP mail function smtp server to point to our company hosted smtp server.

I've successfully pointed mail sent using the php mail function to the new smtp server and everything appears to be working.

I'm a little concerned, because no username or password is required for the php mail function.

Couldn't anyone point to our server and emulate one of our e-mail addresses?

1
  • Assuming your corporate policy doesn't prohibit you doing basic security testing: abuse.net/relay.html
    – Chris S
    Feb 11, 2011 at 20:00

2 Answers 2

6

Potentially, but not necessarily.

You didn't say exactly how the PHP forms on your website work, but I'll presume that they are used to allow your website's visitors to send a message to someone in your company. Presumably, the form bundles the message up into an email for someone at your company's domain and then sends it to your mail server via SMTP.

The fact that your mail server accepts SMTP from anywhere without a username/password isn't harmful provided it only does this for messages addressed to your domain. This is how incoming mail is processed by your mail server.

It would be dangerous, however, if your mail server accepts SMTP from anywhere without a username/password in cases where the message is addressed to a different domain. That would mean your mail server is acting as a relay, which can be exploited by spammers and email forgers.

1
  • Yes, the forms are set to be submitted to our company e-mail addresses. Mox, thanks for the input. I changed the to address to an e-mail address that doesn't belong to our company (outside our domain) and received: SMTP server response: 550 5.4.1 Relay Access Denied. We are protected! =0
    – payling
    Feb 11, 2011 at 20:20
1

I wouldn't recommend allowing an open SMTP even for emails addressed to your domain. The logic is that email spam/forgeries can be targeted at your employees by a knowledgeable hacker/ex-employee. It'll be a scare to send an email marked to "Everyone@company" from the CEO relayed through the company SMTP.

Why don't you use auth with your SMTP for those PHP forms? You could configure auth parameters in SendMail for e.g. Or limit SMTP access to that server's IP address.

1
  • 1
    +1 for a good answer, even if rather late for this question. Nov 14, 2012 at 9:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .