- Open relay, defined
- An open relay is a mail server that accepts and forwards messages from any sender to any recipient without authentication, which spammers locate and use within hours.
Until the late 1990s this was the normal configuration, because the internet was small and mutual trust was the operating assumption. Spam ended that, and closing relays became the first large anti-abuse campaign.
Discovery is automated and fast. Scanners sweep address ranges continuously, and a newly opened relay is usually found and abused within a day.
The consequence is immediate listing. Spamhaus and others list open relays on sight, and the listing survives long after the configuration is fixed unless you request removal.
Testing is straightforward: connect from outside your network and try to send between two external addresses. A 550 relay-denied is the answer you want.
How ZapBounce reports it
Our verification probes never relay anything, because the connection ends before any message body exists. Relay status is a property of a server you operate, and the free SMTP test checks it directly.
Running the relay test by hand
Do this from a machine outside your network, such as a small cloud instance where port 25 is open. Connect to your server on port 25 and type three commands: EHLO test.example, then MAIL FROM:<a@outside-one.example>, then RCPT TO:<b@outside-two.example>. Neither address belongs to a domain your server handles, and that's what makes it a relay attempt.
A closed server refuses at the third line. Postfix says 554 5.7.1 <b@outside-two.example>: Relay access denied, or a 454 4.7.1 version of the same text on some default configurations. Exchange says 550 5.7.54 SMTP; Unable to relay recipient in non-accepted domain.
If you see 250 OK after the RCPT TO, stop and type QUIT. Your server just agreed to carry mail between two strangers. Fix the configuration first, then run the test again, then go looking in the mail queue and logs to see whether anyone found it before you did.
Closed to strangers, open to a stolen password
True open relays are rare now, because default configurations have been closed for many years. What's common is the modern equivalent: a server that correctly demands a login on the submission port, and one mailbox with a weak or reused password. Once an attacker has that login, your server relays their spam for them with your full blessing, and your SPF and DKIM vouch for it.
From a blocklist's point of view the result is identical: your IP sent a burst of junk, and it gets listed.
The defenses are different, though. Put an outbound rate limit on each authenticated account, so a mailbox that normally sends 40 messages a day can't send 40,000 overnight. Alert on sudden volume from a single user, and require multi-factor sign-in where your mail system supports it.
Web forms are the other route. A contact form that lets a visitor control the recipient or inject extra headers is a relay with a web page in front of it, and it won't show up in the SMTP test above.
Open relay: common questions
How do I check for an open relay?
From outside your network, connect and attempt to send between two external addresses. It should be refused.
What happens if my server is an open relay?
Automated scanners find it within about a day, spam flows through it, and blocklist listings follow immediately.
Is an open relay the same as a catch-all?
No. A catch-all accepts any recipient at its own domain. An open relay forwards mail for domains it has nothing to do with.