I have noticed that it's possible to telnet into a mailserver that I own and send spoofed messages to other clients. This only works for the domain that the mail server is regarding; I cannot do it for other domains.
For example; lets say that I own example.com. If I telnet example.com 25 I can successfully send a message to another user without authentication:
HELO local
MAIL FROM:
[email protected]
RCPT TO:
[email protected]
DATA
SUBJECT: Whatever this is spam
Spam spam spam
.
I consider this a big problem; how do I secure this?