Product Code Database
An open mail relay is a Simple Mail Transfer Protocol (SMTP) server configured in such a way that it allows anyone on the Internet to send Email through it, not just mail destined to or originating from known users. This used to be the default configuration in many mail servers; indeed, it was the way the Internet was initially set up, but open mail relays have become unpopular because of their exploitation by Spamming and computer worm. Many relays were closed, or were placed on blacklists by other servers.
Since open mail relays make no effort to authentication the sender of an e-mail, open mail relays are vulnerable to Email spoofing.
This trend reduced the percentage of mail senders that were open relays from over 90% down to well under 1% over several years. This led spammers to adopt other techniques, such as the use of of zombie computers to send spam.
One consequence of the new unacceptability of open relays was an inconvenience for some end users and certain Internet service providers. To allow customers to use their e-mail addresses at Internet locations other than the company's systems (such as at school or work), many mail sites explicitly allowed open relaying so that customers could send e-mail via the ISP from any location. Once open relay became unacceptable because of abuse (and unusable because of blocking of open relays), ISPs and other sites had to adopt new protocols to allow remote users to send mail. These include , SMTP-AUTH, POP before SMTP, and the use of virtual private networks (VPNs). The Internet Engineering Task Force (IETF) has written a best current practices covering Email Submission Operations in RFC 5068.
Note that the above only becomes an issue if the user wishes to (or has to) continue to send e-mail remotely, using the same SMTP server which they were previously accessing locally. If they have valid access to some other SMTP server from their new, remote location, then they will typically be able to use that new server to send e-mails as if from their old address, even when this server is properly secured. (Although this may involve some reconfiguration of the user's email client which may not be entirely straightforward.)
The CAN-SPAM Act of 2003 makes it illegal to send spam through an open relay in the United States, but makes no provision on their use for personal e-mail or their operation in general; the effectiveness of the act has been questioned. United States: A New Weapon in The Fight Against Spam Is the CAN-SPAM Law Working?
John Gilmore and other open relay proponents declare that they do not support spam and spamming, but see bigger threat in attempts to limit Web capabilities that may block evolution of the new, next generation technologies. They compare the network communication restrictions with restrictions that some phone companies tried to place on their lines in the past, preventing transferring of computer data rather than speech.
In particular, a properly secured SMTP mail relay should not accept and forward arbitrary e-mails from non-local IP addresses to non-local mailboxes by an unauthenticated or unauthorized user.
In general, any other rules an administrator chooses to enforce (for instance, based on what an e-mail gives as its own Bounce address address) must be in addition to, rather than instead of, the above. If not, the relay is still effectively open (for instance, by the above rules): it is easy to forge e-mail header and envelope information, it is considerably harder to successfully forge an IP address in a TCP/IP transaction because of the three-way handshake that occurs as a connection is started.
Open relays have also resulted from security flaws in software, rather than misconfiguration by system administrators. In these cases, security patches need to be applied to close the relay.
Internet initiatives to close open relays have ultimately missed their intended purpose, because spammers have created distributed botnets of zombie computers that contain malware with mail relaying capability. The number of clients under spammers' control is now so great that previous anti-spam countermeasures that focused on closing open relays are no longer effective.
|
|
