SMTP server is an open relay

Your SMTP server accepts and forwards mail from unauthenticated external senders to arbitrary recipients.

Impact — Critical impact

Open relays are harvested by spam botnets within hours of exposure on port 25, and every message they forward is attributed to your IP and PTR. Expect listings on Spamhaus XBL/CBL, SORBS, and Barracuda, plus upstream provider termination notices and permanent reputation damage that persists after the relay is closed. All legitimate mail from the host — transactional, marketing, and user-to-user — will be blocked or deferred by every major receiver until the IP is rotated and warmed from scratch.

What causes it

Postfix mynetworks set to 0.0.0.0/0 or a broad CIDR after a misguided troubleshooting change, allowing any client IP to submit mail without authentication.
Exim or Sendmail RELAY ACL left permissive from a legacy configuration (e.g., relay_from_hosts = * or empty access database), typically on servers upgraded in place over many years.
SMTP AUTH enabled on port 25 without TLS enforcement and with a weak or default password that was brute-forced, turning an authenticated relay into a de facto open one.
Misconfigured smart host or MX backup where the server was intended to relay for one domain but relay_domains was never scoped, so it accepts mail for any destination.
A compromised web application or cPanel/Plesk account with mail-send permissions that is being abused through the local MTA, which from outside looks identical to an open relay.

How to fix it

Confirm the relay is actually open before changing anything

Test from an external host you control — never from the same network. A positive result means any RCPT TO for a domain you don't host was accepted. If the server responds 554 Relay access denied the test is negative.

swaks --server mail.example.com --from test@external.tld \
  --to recipient@gmail.com --h-Subject 'relay test'

Lock down Postfix to authenticated or trusted networks only

In /etc/postfix/main.cf, restrict mynetworks to loopback and your actual submission sources, and require permit_sasl_authenticated before reject_unauth_destination in smtpd_recipient_restrictions. Reload Postfix and re-run the swaks test.

mynetworks = 127.0.0.0/8 [::1]/128
smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination

systemctl reload postfix

Move user submission off port 25

Port 25 should only accept inbound mail for domains you host. Enable the submission ports (587 with STARTTLS, 465 with implicit TLS) in master.cf and require authentication there. Firewall port 25 to inbound-only from the public internet so compromised accounts cannot use it to send.

submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject

Request delisting and monitor reputation

Once the relay is closed and no abuse traffic has left the IP for 24-48 hours, submit delisting requests to Spamhaus, SORBS, and Barracuda. Watch SMTP logs for continued auth brute-force attempts and rotate any SASL credentials that were exposed. If the IP's reputation is unrecoverable, migrate sending to a clean IP or a managed service.

Fixed it? Run a fresh test to confirm.

Test my inbox →