Spam Free Email

So if open relay are bad, then what is the proper way to have things setup?

For the most part there are two different ways that email server are setup to be closed relays.

First off most email servers can easily be configured to only accept email from client software from specific IP addresses. This allows the email server to accept anything from any IP address on the Internal network, while rejecting anything from the outside world. When receiving email from another email server the receiving server should only accept email for a list of known email domains. This is usually a pretty short list.

The second way is to have the email user authenticate themselves before the email will be sent. This is a handy thing to do if you have users with laptops outside of your office that will be sending email as though they were inside you office. This is also nearly mandatory for anyone who is considering implementing SPF on their server and domain.

I don’t even know how many time this problem has been brought up or how many articles have been written about this, but it never seems to get fixed. That problem being Open Relays.

An open relay is an email server that will send email from any client software anywhere on the Internet. When the Internet was first designed this was not a concern. In fact this was most likely a very useful feature, if your mail server was down you could send you email through someone else’s. Easy, convenient and completely insecure

Once the Internet was converted to be used as a commercial environment this became a problem. Now any person with a computer can send a million email message to an email server that is an open relay and then the resources of that server are used and abused to send out those messages.

To make this a bit clearer, if a spammer sent one 100Kb message to an open relay and it was destined to go to one million people, then that 100Kb message would be sent out 1,000,000 times. So the spammer send out 100Kb of data and the abused email server sent out 100,000,000Kb or 100,000MB of data.

Not only does the person who owns the open relay get taken advantage of, but now the people who have been sent those spam massages have another piece of spam to deal with.