Your mail server is an open relay

What it means

A mail server has two normal jobs: accept email for your own domains, and send email for your own users after they log in. An open relay does a third thing: it accepts email from anyone, to anyone, and passes it on. Spammers scan the internet constantly for such servers and use them to send huge volumes in your name.

Why it matters

• Your IP is added to blacklists quickly, and then even your normal emails are refused.
• Your hosting company may suspend the server for abuse.
• Your server's resources and bandwidth are used by strangers.

How to check

• Look at your mail queue. A large queue full of emails you did not send is a strong sign. In Postfix: mailq.
• Read /var/log/mail.log for unknown senders sending to many outside addresses.
• Check your IP at /blacklists.
• Test from another machine outside your network. Connect with telnet mail.yourdomain.com 25, then type:

  HELO test.example.com
  MAIL FROM:<someone@example.com>
  RCPT TO:<someone-else@example.org>

  A safe server refuses the last line with an error like 554 5.7.1 Relay access denied or 454 4.7.1. If it answers 250, it is an open relay. Type QUIT without sending anything.

How to fix it

Postfix

1. Limit trusted networks to the server itself in /etc/postfix/main.cf:

   mynetworks = 127.0.0.0/8 [::1]/128

   Never put 0.0.0.0/0 or a large public range here.
2. Only allow trusted networks and logged-in users to relay:

   smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination

3. Make sure relay_domains lists only domains you really handle.
4. Reload: postfix reload.

Other servers

Exim, Exchange, hMailServer and others have the same idea under different names: look for "relay", "allowed IPs" or "trusted networks" and allow only authenticated users and localhost.

Also check for stolen accounts

Sometimes the server is not open, but a mailbox password was stolen and spam is sent with a real login. The log then shows a username next to each spam. Change that password, check for weak passwords on all accounts, and consider tools like fail2ban that block repeated login attempts. Old website scripts or contact forms can also be abused to send spam.

Clean up

1. Remove the spam from the queue. In Postfix, postsuper -d ALL deferred deletes deferred messages; check carefully that no real emails are waiting.
2. Check your IP again at /blacklists and request removal from each list once the problem is fixed. The paid dashboard's blacklist removal tools can help track this.

Check that it is fixed

Repeat the telnet test from outside: the RCPT line to an outside address must be refused. Then send a normal email from a real account to your test address on the home page (/) to confirm that legitimate sending still works and no blacklist is reported.