http://members.iinet.net.au/~remmie/relay/

The web page listed above will allow you to relay email through ANY plesk server, irrespective of the mail authentication options, unless SMTP is turned off entirely, or the IP is banned.

To reiterate, ALL PLESK SERVERS contain a bug allowing any spammer to use your mail server for open relay.

Is there a resolution that I'm not aware of?
I found this in plesk forums. Seems this bug works. I tried it with ensim mail server but it failed. On all the plesk servers I tried, it works well ..

.

I tested it with plesk 2.5 running server. Relaying is denied (in configuration) and only permitted with authentication, but with this bug, it works. It sends Email from the target server running any version of plesk.

THIS IS NOT AN OPEN RELAY BUG ON PLESK.... ITS BUG FREE UNLIKE CPANEL hehehehe I love saying that :D

This is what a felow plesk forum member said:

I have tested it myself and the test they made suc**. The E-mail address, say test@not_your_domain.com will (also) be changed to test@not_your_domain@domain.com and domain.com (this is the servers name) is in your rcpthost thus it will be accepted. It will NOT be sent to test@not_your_domain however!!

So, this is NOT an open relay bug.

heeh, Ok fine. Suppose this is not a bug with PLESK. Try the same URL, give target host mail.ensim.com or any other mail server and compare the results with your PLESK running host. You will see the difference.

Here are both results with plesk.com and ensim.com the exact same result.


this is with plesk

Open Relay Test Results

Default domain is staff.iinet.net.au

Connecting to plesk.com ...

<<< 220 plesk.com ESMTP
>>>> HELO staff.iinet.net.au
<<< 250 plesk.com

To: memin@luna.com
From: spamtest@localhost
>>>> MAIL FROM:
<<< 250 ok
>>>> RCPT TO:
<<< 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)

To: memin@luna.com
From: spamtest
<<< 250 flushed
>>>> MAIL FROM:
<<< 250 ok
>>>> RCPT TO:
<<< 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)

To: memin@luna.com
From:
<<< 250 flushed
>>>> MAIL FROM:<>
<<< 250 ok
>>>> RCPT TO:
<<< 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)

To: memin@luna.com
From: spamtest@plesk.com
<<< 250 flushed
>>>> MAIL FROM:
<<< 250 ok
>>>> RCPT TO:
<<< 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)

To: memin@luna.com
From: spamtest@[207.174.151.183]
<<< 250 flushed
>>>> MAIL FROM:
<<< 250 ok
>>>> RCPT TO:
<<< 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)

To: memin%luna.com@plesk.com
From: spamtest@plesk.com
<<< 250 flushed
>>>> MAIL FROM:
<<< 250 ok
>>>> RCPT TO:
<<< 250 ok
>>>> DATA
<<< 354 go ahead
>>>> MESSAGE
<<< 250 ok 1022039401 qp 73408

SUCCESS

Relay Accepted - final response code 250

Check your email


This is with mail.ensim.com

Open Relay Test Results

Default domain is staff.iinet.net.au

Connecting to mail.ensim.com ...

<<< 220 nasdaq.ms.ensim.com ESMTP Server (Microsoft Exchange Internet Mail Service 5.5.2653.13) ready
>>>> HELO staff.iinet.net.au
<<< 250 OK

To: memin@luna.com
From: spamtest@localhost
>>>> MAIL FROM:
<<< 250 OK - mail from
>>>> RCPT TO:
<<< 550 Relaying is prohibited

To: memin@luna.com
From: spamtest
<<< 250 OK - Reset
>>>> MAIL FROM:
<<< 250 OK - mail from
>>>> RCPT TO:
<<< 550 Relaying is prohibited

To: memin@luna.com
From:
<<< 250 OK - Reset
>>>> MAIL FROM:<>
<<< 250 OK - mail from <>
>>>> RCPT TO:
<<< 550 Relaying is prohibited

To: memin@luna.com
From: spamtest@mail.ensim.com
<<< 250 OK - Reset
>>>> MAIL FROM:
<<< 250 OK - mail from
>>>> RCPT TO:
<<< 550 Relaying is prohibited

To: memin@luna.com
From: spamtest@[65.164.64.250]
<<< 250 OK - Reset
>>>> MAIL FROM:
<<< 250 OK - mail from
>>>> RCPT TO:
<<< 550 Relaying is prohibited

To: memin%luna.com@mail.ensim.com
From: spamtest@mail.ensim.com
<<< 250 OK - Reset
>>>> MAIL FROM:
<<< 250 OK - mail from
>>>> RCPT TO:
<<< 250 OK - Recipient
>>>> DATA
<<< 354 Send data. End with CRLF.CRLF
>>>> MESSAGE
<<< 250 OK

SUCCESS

Relay Accepted - final response code 250

Check your email

This is not a relay bug in either Plesk or Ensim. It is simply passing anything you type in, to your actual domain running the SMTP server. So yes it will succesfully do this because your domain is the one running the SMTP server. You can see until it does this each one of the relay tests fail for both CP's. The worse that can be done here is someone could flood your mailboxes but no mail will ever go anywhere off of your domain.. So you would be spamming yourself..

This was brought up about 2 months ago and the same test site was used then as well.

No problems with either CP as long as you use authorization.