# SMTP Open Relay Testing

- **URL:** https://hackindex.io/services/smtp/vulnerability-discovery/smtp-open-relay
- **Path:** SMTP > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/smtp/vulnerability-discovery.md)
- **Published:** 2026-03-29
- **Updated:** 2026-03-29

## SMTP Open Relay Testing

An open relay accepts mail from any sender to any recipient without authentication: including external domains. This allows an attacker to send email through the target's mail server, which is trusted by spam filters, SPF checks, and recipient mail systems. Open relays are a direct path to phishing delivery and spam abuse through a trusted IP. Confirmed open relay enables phishing delivery and spam abuse through a trusted IP.

- Automated Relay Check with nmap
- Manual Relay Confirmation
- Relay Bypass Variants
- Check SPF Record

## Automated Relay Check with nmap

The smtp-open-relay NSE script tests multiple relay bypass combinations automatically:

```bash
nmap -p 25 --script smtp-open-relay $TARGET_IP
# | smtp-open-relay: Server is an open relay (16/16 tests)
# |_  MAIL FROM:<> -> RCPT TO:<relaytest@gmail.com>
```

16/16 tests passing confirms a fully open relay. Even partial results like 4/16 indicate some relay bypass conditions exist and warrant manual verification.

## Manual Relay Confirmation

Connect and attempt to route a message from an external sender to an external recipient. Both addresses must be outside the target domain:

```bash
nc -nv $TARGET_IP 25
# 220 mail.company.com ESMTP
```

```
EHLO attacker.com
MAIL FROM:<attacker@attacker.com>
RCPT TO:<target@external-domain.com>
DATA
Subject: relay-test

relay-test-body
.
QUIT
```

```bash
echo -e 'EHLO attacker.com\nMAIL FROM:<attacker@attacker.com>\nRCPT TO:<probe@protonmail.com>\nDATA\nSubject: relay-test\n\ntest\n.\nQUIT' | nc -nv $TARGET_IP 25
# 250 2.0.0 Ok: queued as A1B2C3D4E5
```

A queued response without authentication confirms open relay. The server accepted a message with an external sender to an external recipient and queued it for delivery. Some servers accept RCPT but reject at the DATA or queue stage: test with a controlled inbox you own to confirm actual delivery if your engagement rules permit.

## Relay Bypass Variants

Some servers block obvious relay attempts but miss certain bypass patterns. Test these when a direct relay attempt is rejected:

```bash
echo -e 'EHLO test\nMAIL FROM:<>\nRCPT TO:<probe@protonmail.com>\nDATA\n\ntest\n.\nQUIT' | nc -nv $TARGET_IP 25
```

```bash
echo -e 'EHLO test\nMAIL FROM:<postmaster@$DOMAIN>\nRCPT TO:<probe@protonmail.com>\nDATA\n\ntest\n.\nQUIT' | nc -nv $TARGET_IP 25
```

## Check SPF Record

Confirm whether the target domain has an SPF record that would limit relay impact. If SPF is absent or has a soft fail (~all), relay abuse is harder to detect and filter by recipients:

```bash
dig TXT $DOMAIN | grep spf
# "v=spf1 include:mailgun.org ~all"
```

`~all` is a soft fail: most mail will still be delivered even if it fails SPF. `-all` is a hard fail. No SPF record means any server can claim to send mail from this domain. Combine open relay with absent or weak SPF to assess the full phishing risk.

## References

- [nmap: smtp-open-relay NSE](https://nmap.org/nsedoc/scripts/smtp-open-relay.html) - Automated open relay bypass testing with 16 test combinations