Exchange 2010 – Unauthenticated users can send/relay local mail via telnet. How to stop this

exchange-2010smtp

I'm completely new to Exchange administration. I have Exchange 2010 installed and working for the most part.

The domain in question is mydomain.com.

I have checked to make sure the server is not an open relay by testing it through telnet.

  • Mail delivery always succeeds if I send mail from djsdhfs@sjsdfjd.com to person1@mydomain.com, as it should.
  • Mail delivery always fails if I send mail from dfjdfkjfgdfj@kfjgdf.com to someoneelse@anotherdomain.com (unable to relay), as it should.
  • I have to double check what happens if I send mail from myself@mydomain.com to myself@anotherdomain.com (I don't have access to the server right now, but I'm pretty sure it worked the last time I tested it).

But what also always succeeds is sending mail from person1@mydomain.com to person2@mydomain.com. Or person3@mydomain.com to person4@mydomain.com. This looks like a phishing attack waiting to happen since there is no authentication performed whatsoever.

What I don't know is, what can I do about this? I didn't see much in the way of authentication options when setting up the SMTP connector, just a checkbox concerning mutual TLS, and I don't want to blindly enable things when I don't know what they do (like allowing external authentication when there is none).

Any advice?

Thanks!

Best Answer

I suspect that, if it's configured correctly, mail from yourself@yourdomain.com to someoneelse@someotherdomain.com will only succeed if you're using Outlook or some other client that provides integrated authentication. (IOW, not telnet.)

Your server is set to accept mail for yourdomain.com. Remote users do not have to authenticate on your server to send you mail. If you telnet in and say that you're sending in mail from fakeuser@yourdomain.com to realuser@yourdomain.com, the mail will be accepted (although you can tell Exchange to refuse mail for invalid addresses), because you accept mail for yourdomain.com. Exchange may properly flag that mail as spam or phish, however. (People emailing themselves test messages are frequently intercepted as spam on my system, for example.)

Configuring your antispam options in a way that suits your enviroment should help. This link is an overview to Exchange antispam.

Related Topic