Security: say what the relaying checks actually mean

jcoffey-dev commented

2026-10-14 18:37:12 +00:00

Owner

SS-3 claimed a domain with relaying on relays mail for anyone; it actually accepts mail to unknown addresses at that domain, to pass on. SS-2 now names the edge-server case (docs: Run it > An edge server in front) and says to check the rule before accepting it. Wording only, severities unchanged. Found while testing the edge-server setup for the forum.

jcoffey-dev added 1 commit 2026-10-14 18:37:13 +00:00

Security: say what the relaying checks actually mean

ci / build (pull_request) Skipped

Details

ci / publish (pull_request) Skipped

Details

ci / notices (pull_request) Successful in 44s

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 1m44s

Details

fe84883812

SS-3 said a domain with relaying on 'relays mail for anyone' and that mail
'claiming to be from' it is passed on without sign-in. The flag does
neither: it makes the server accept mail to unknown addresses at that
domain, to pass on, instead of refusing them. Its title and why now say
that, and what goes wrong when it's on by mistake (late bounces, often to
forged senders). SS-2 keeps its open-relay warning and adds the deliberate
case, an edge server in front of another one, and what to check before
accepting it. Severities are unchanged.

jcoffey-dev merged commit cf58dfaecb into main

2026-10-14 18:39:20 +00:00

jcoffey-dev deleted branch security/relay-wording

2026-10-14 18:39:20 +00:00

Security: say what the relaying checks actually mean #111