search

mailhog / MailHog

Web and API based SMTP testing
MIT License
14.06k stars 1.07k forks source link

How to stop open relay? #350

Open kevmando opened 3 years ago

kevmando commented 3 years ago

Hi, We just tried mail hog for email message tests and security scan caught our MTA has open relay.

but I cannot find how to limit the domain or address in mail hog setting. How can I stop open relay?

HorayNarea commented 3 years ago

You can't, MailHog is not a real MTA, it should not be accessible from the internet. It's only for development on your dev-machine.

kevmando commented 3 years ago

Thanks. Is there any alternative you can suggest? I see postfix, but it seems it does not come with test feature like mailhog?

HorayNarea commented 3 years ago

As far as I know, there is no "real MTA but also with test features", because that's inherently insecure (or at least extremely difficult to make it secure).

What is it exactly that you want/need? …why is postfix (or any other real MTA) on a server in production and mailhog on your local machine for developing not working for you?

kevmando commented 3 years ago

It's more of QA requirement. QA wants to verify email contents with e2e automation tool. And obviously all services are in the cloud, they want their test toolset on cloud as well.

We already use aws ses to send mail for production. We have used gmail to test with aws ses, but the company security doesn't allow to use gmail any more + mailhog api seems better for them.

HorayNarea commented 3 years ago

Hmm I see… well MailHog is not really suitable for that scenario :/

I've never used SES but a few years ago I've used Mailgun (which is basically the same) and that provided a test-environment where all mails that you send will only get delivered to previously defined adresses… maybe you could check that out or search if SES has a similar feature?