Spam mail through SMTP and user spoofing
- by Josten Moore
I have noticed that it's possible to telnet into a mailserver that I own and send spoofed messages to other clients. This only works for the domain that the mail server is regarding; I cannot do it for other domains.
For example; lets say that I own example.com. If I telnet example.com 25 I can successfully send a message to another user without authentication:
HELO local
MAIL FROM: [email protected]
RCPT TO: [email protected]
DATA
SUBJECT: Whatever this is spam
Spam spam spam
.
I consider this a big problem; how do I secure this?