Please try this on your mail server. I have already tried it on many servers, including postfix and sendmail. All are vulnerable.

telnet mailhost 25 helo hostname mail from: <> rcpt to: user@mailhost data ...

the important things are - 1. the mail from address is blank: <> 2. the rcpt to addresses are within the mail servers domains so relay is not a problem

This allows spammers to send mail using a null return address. In the mail, the address gets translated to MAILER-daemon.

To fix it in sendmail, go down to ruleset 3, search for a line that starts with R<>

It should look like this:

R<> $@ < @ > MAIL FROM:<> case

change it to this:

R<> $#error $@ 5.1.3 $: "User address required"

That should block anonymous senders.

Any idea why this is allowed (there is a special rule to allow it) at all?

Philip