Is Your Exchange Server Relay-Secure?

In August 1999, Microsoft released an Exchange Server 5.5, post-Service Pack 2 (SP2) hotfix to address a specific Exchange mail-relaying vulnerability. This fix plugged a security hole that let the Internet Mail Service (IMS) relay encapsulated SMTP messages, even if you'd configured the server to prevent relaying.

Many companies, however, haven't secured their servers. In a quick test of 20 sites, I found that between 60 and 70 percent of them either hadn't applied this security patch or hadn't configured their servers to block relays in the manner that the Internet Engineering Task Force (IETF) Request for Comments (RFC) 2505 suggests.

If you haven't completely secured your server against relaying, an outsider can use your server to deliver email that appears to have originated from your server and possibly from one of your mail accounts. In the United States and other countries, people periodically debate whether systems' owners are liable if someone uses their system as a relay. The crux of the debate is whether an owner knew about the problem but chose to do nothing about it. Aside from concern about owners' liability, relaying is also a form of Denial of Service (DoS) attack because it takes system resources away from legitimate operations. Relaying is also bad for your company's business because it can generate ill will among your customers. . . .