Skip to content
HackIndex logo

HackIndex

SMTP Open Relay Testing

2 min read Mar 29, 2026

An open relay accepts mail from any sender to any recipient without authentication — including external domains. This allows an attacker to send email through the target's mail server, which is trusted by spam filters, SPF checks, and recipient mail systems. Open relays are a direct path to phishing delivery and spam abuse through a trusted IP. Confirmed open relay moves to relay exploitation.

Automated Relay Check with nmap

The smtp-open-relay NSE script tests multiple relay bypass combinations automatically:

┌──(kali㉿kali)-[~]
└─$ nmap -p 25 --script smtp-open-relay $TARGET_IP 
| smtp-open-relay: Server is an open relay (16/16 tests)
|_  MAIL FROM:<> -> RCPT TO:<[email protected]>

16/16 tests passing confirms a fully open relay. Even partial results like 4/16 indicate some relay bypass conditions exist and warrant manual verification.

Manual Relay Confirmation

Connect and attempt to route a message from an external sender to an external recipient. Both addresses must be outside the target domain:

┌──(kali㉿kali)-[~]
└─$ nc -nv $TARGET_IP 25 
220 mail.company.com ESMTP
EHLO attacker.com
MAIL FROM:<attacker@@attacker.com>
RCPT TO:<target@@external-domain.com>
DATA
Subject: relay-test

relay-test-body
.
QUIT
┌──(kali㉿kali)-[~]
└─$ echo -e 'EHLO attacker.com\nMAIL FROM:<[email protected]>\nRCPT TO:<[email protected]>\nDATA\nSubject: relay-test\n\ntest\n.\nQUIT' | nc -nv $TARGET_IP 25 
250 2.0.0 Ok: queued as A1B2C3D4E5

A queued response without authentication confirms open relay. The server accepted a message with an external sender to an external recipient and queued it for delivery. Some servers accept RCPT but reject at the DATA or queue stage — test with a controlled inbox you own to confirm actual delivery if your engagement rules permit.

Relay Bypass Variants

Some servers block obvious relay attempts but miss certain bypass patterns. Test these when a direct relay attempt is rejected:

┌──(kali㉿kali)-[~]
└─$ echo -e 'EHLO test\nMAIL FROM:<>\nRCPT TO:<[email protected]>\nDATA\n\ntest\n.\nQUIT' | nc -nv $TARGET_IP 25
┌──(kali㉿kali)-[~]
└─$ echo -e 'EHLO test\nMAIL FROM:<postmaster@$DOMAIN>\nRCPT TO:<[email protected]>\nDATA\n\ntest\n.\nQUIT' | nc -nv $TARGET_IP 25

Check SPF Record

Confirm whether the target domain has an SPF record that would limit relay impact. If SPF is absent or has a soft fail (~all), relay abuse is harder to detect and filter by recipients:

┌──(kali㉿kali)-[~]
└─$ dig TXT $DOMAIN | grep spf 
"v=spf1 include:mailgun.org ~all"

~all is a soft fail — most mail will still be delivered even if it fails SPF. -all is a hard fail. No SPF record means any server can claim to send mail from this domain. Combine open relay with absent or weak SPF to assess the full phishing risk.

References