SMTP Open Relay Checks

AFFECTED SYSTEMS

SMTP mail servers running in open relay configurations.

BACKGROUND

Simple Mail Transfer Protocol (SMTP) is an electronic mail communication protocol that became an internet standard with RFC 821 and was updated in RFC 5321. SMTP servers can be configured as open relays. In this configuration, the server doesn’t authenticate its users. This was the original design of the web but since then open relay configurations have become scarce since they were easily exploited by spammers.

DESCRIPTION

Open relay configurations today are frowned upon and not recommended. Some more common reasons today as to why a SMTP server operates in this configuration is misconfiguration, leaving POPb4SMTP enabled or compromised. With this vulnerability, attackers are able to send email originating from your domains easily, leading to social engineering fraud opportunities which may cause irreparable damage to reputation. At extreme cases, this might allow attackers to fool customers and personnel into surrendering highly critical personal data such as credit card information.

SOLUTION

The solution to this problem is highly dependent on your mail server provider. After identifying the problem through the Onlayer interface, find out your mail server solution. If it is a cloud service, contact your service provider. If not, get further information about the solution with regards to your mail server solution.

One solution that is currently supported by all major ISPs (such as Google, Microsoft, Yahoo etc.) is setting up a DMARC record on your DNS, which defines how a domain handles suspicious e-mails.

A DMARC record contains a policy that will be placed in your domain’s DNS as a TXT record. The name for the record should be “_dmarc.example.com”, where “example.com” is replaced by your actual domain name.

An example DMARC record can be like this:

_dmarc.onlayer.com. 7199 IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"

Above record dictates: “Reject all messages that fail the DMARC check and e-mail a daily report to [email protected]”

To perform this, login to your DNS management panel and add a new TXT record where:

TXT Record Name: _dmarc.example.com

TXT Record Value: v=DMARC1; p=reject; rua=mailto:[email protected]

This will prevent mails from being sent on your behalf entirely. If you solely use a service provider like G-Suite for mailing purposes, this probably is the safest choice.

If you wish to quarantine the said e-mails, instead of outright rejecting them, setting the policy to p=quarantine is enough and if you only wish to monitor these emails, set policy to p=monitor.

Note that changes to DNS records may take up to 48 hours before they fully propagate.

LEGAL

Permission is granted for the redistribution of this alert by explicitly linking the page to be referred. It may not be edited in any way without written consent.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties concerning this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from the use of, or reliance on, this information.