How it works
A mail server should accept mail in only two cases: for recipients in its own domains, and for relaying when the sender has authenticated (SMTP AUTH, usually on port 587) or connects from a trusted network. An open relay forwards any message to any address.
That used to be the default; since the anti-spam recommendations in RFC 2505, every common mail server blocks relaying out of the box. Today an open relay is usually the result of misconfiguration: trusted networks defined too broadly, a smarthost without authentication, or a form script that accepts arbitrary recipients.
You can test it with an SMTP session from an outside IP: a message with an unrelated sender to an unrelated domain must be refused with an error such as 554 5.7.1 Relay access denied.
Why it matters
Spammers find open relays quickly through automated scans and push large volumes of spam and phishing through them. The IP address ends up on blocklists such as Spamhaus, and receivers then reject the company’s legitimate mail as well.
On top of that come server load, clogged queues, thousands of bounces and, in the worst case, a hosting provider that blocks the IP or the whole server.
How to prevent it
- Allow relaying only for authenticated users (SMTP AUTH on port 587 or 465) and keep trusted networks as narrow as possible.
- Run a relay test from an outside IP after every change to the mail server configuration.
- Build contact forms and scripts so they only send to fixed recipients.
- Send the website’s transactional mail through a mail provider with authentication instead of a self-hosted server.
- Monitor mail logs and the queue for unusual volumes.
How DomainWarn detects it
DomainWarn does not run an open relay test, so this is not checked directly. The SMTP check does connect to up to five MX hosts on port 25 and checks the banner, STARTTLS, TLS version and certificate, but it never hands over a message: no sender, no recipient, and therefore no relay attempt.
The blacklist check helps indirectly: once an open relay is abused, the mail server IP usually lands on lists such as Spamhaus ZEN, SpamCop, Barracuda or PSBL quickly. DomainWarn reports a listed mail server IP as critical and opens a “Listed on a blacklist” incident.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.