I'm trying to secure my MTA against relaying spam, and am trying to understand what's involved.

For example: Say I send an email using an Yahoo account to a Gmail account. When Yahoo is relaying the email to Gmail, does the relay take place without authentication? What do you need as the server to be able to successfully relay emails to another smtp server?

How do I set up an MTA to prevent spam relay?

closed as too broad by joeqwerty, Hyppy, dawud, 84104, masegaloeh Apr 18 '15 at 3:02

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    What alphamikevictor said below. I also wanted to add that if the mail servers are properly configured (to prevent spam relay), then in your example above Yahoo will only accept mail that is authenticated or from its proper network, and Gmail will only accept mail that's for Gmail. – Katherine Villyard Apr 17 '15 at 14:50
  • My question really is, how to set up an MTA to prevent spam relay – user1720897 Apr 17 '15 at 14:53
  • Ah, that's not exactly what you asked. – Katherine Villyard Apr 17 '15 at 15:09
  • 1
    It would help if you told us what MTA you were using. – Katherine Villyard Apr 17 '15 at 15:30
  • @KatherineVillyard Exim – user1720897 Apr 18 '15 at 0:49

Basically they perform a query for MX record of the domain, following your question, for gmail.com:

alphamikevictor@ges01:~ > nslookup -query=mx gmail.com

Non-authoritative answer:
gmail.com       mail exchanger = 30 alt3.gmail-smtp-in.l.google.com.
gmail.com       mail exchanger = 40 alt4.gmail-smtp-in.l.google.com.
gmail.com       mail exchanger = 5 gmail-smtp-in.l.google.com.
gmail.com       mail exchanger = 10 alt1.gmail-smtp-in.l.google.com.
gmail.com       mail exchanger = 20 alt2.gmail-smtp-in.l.google.com.

Authoritative answers can be found from:
alt3.gmail-smtp-in.l.google.com internet address =
alt4.gmail-smtp-in.l.google.com internet address =
alt1.gmail-smtp-in.l.google.com internet address =
alt2.gmail-smtp-in.l.google.com internet address =

For each authorized SMTP server you have a weigh so Yahoo's MTA will try to deliver to gmail address using this servers:

  1. gmail-smtp-in.l.google.com
  2. alt1.gmail-smtp-in.l.google.com
  3. alt2.gmail-smtp-in.l.google.com
  4. alt3.gmail-smtp-in.l.google.com
  5. alt4.gmail-smtp-in.l.google.com

You can read more about MX record at WikiPedia http://en.wikipedia.org/wiki/MX_record

  • So, Yahoo's MTA will be able to send the mail to GMail's MTA without any authentication? Which means that if I set up an MTA, I would be able to send mails to another domain without authentication, or in other words, spam? – user1720897 Apr 17 '15 at 14:51
  • As far as gmail MTA's are getting the mail for themselves there is no need to authenticate (normally). You need authentication when you use Gmail MTA to send mail to another domain otherwise anyone would use Gmail MTAs to send mails all over the world. Or look with another point of view: you as an external user, how do you authenticate to other MTA system which has no relationship with you? – alphamikevictor Apr 17 '15 at 15:09
  • @user1720897 Yes, if a mail server is authoritative for example.com, you end up accepting spam for example.com. Alas. That's a whole other topic. The point is more that if your mail server is authoritative for example.com, you don't send spam to other domains. – Katherine Villyard Apr 17 '15 at 15:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.