From fe84883812a131398930c7bf4e9a3f3b882eee03 Mon Sep 17 00:00:00 2001
From: John Coffey <john@coffeylabs.org>
Date: Wed, 14 Oct 2026 11:37:08 -0700
Subject: [PATCH] Security: say what the relaying checks actually mean

SS-3 said a domain with relaying on 'relays mail for anyone' and that mail
'claiming to be from' it is passed on without sign-in. The flag does
neither: it makes the server accept mail to unknown addresses at that
domain, to pass on, instead of refusing them. Its title and why now say
that, and what goes wrong when it's on by mistake (late bounces, often to
forged senders). SS-2 keeps its open-relay warning and adds the deliberate
case, an edge server in front of another one, and what to check before
accepting it. Severities are unchanged.
---
 src/features/security/checks.ts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/features/security/checks.ts b/src/features/security/checks.ts
index 6d6da75..cdcede0 100644
--- a/src/features/security/checks.ts
+++ b/src/features/security/checks.ts
@@ -247,7 +247,7 @@ export function evaluate(s: Snapshot, defaults: Defaults): Result {
         subject: '',
         value: normalizeExpr(now),
         title: 'The rule for who may relay mail has been changed',
-        why: 'A wrong rule makes this an open relay that spammers find within hours. It may be deliberate, so check it.',
+        why: 'A rule that lets anyone relay makes this an open relay, which spammers find within hours. An edge server in front of another one changes it on purpose, to take in mail for your own domains: if that’s this server, check the rule names only them, then accept it.',
         action: {
           kind: 'review',
           viewName: 'x:MtaStageRcpt',
@@ -261,7 +261,7 @@ export function evaluate(s: Snapshot, defaults: Defaults): Result {
     ];
   });
 
-  check('SS-3', 'Domains that relay for anyone', ['domains'], () => {
+  check('SS-3', 'Domains that accept unknown addresses', ['domains'], () => {
     const relaying = (s.domains ?? []).filter((d) => d.allowRelaying).map((d) => d.name);
     if (relaying.length === 0) return [];
     return [
@@ -272,9 +272,9 @@ export function evaluate(s: Snapshot, defaults: Defaults): Result {
         value: [...relaying].sort(),
         title:
           relaying.length === 1
-            ? `${relaying[0]} relays mail for anyone`
-            : `${relaying.length} domains relay mail for anyone`,
-        why: 'Mail claiming to be from these domains is passed on without sign-in, which spammers can use.',
+            ? `${relaying[0]} accepts mail for addresses that don’t exist here`
+            : `${relaying.length} domains accept mail for addresses that don’t exist here`,
+        why: 'Mail to an unknown address at these domains is taken in to be passed on, instead of refused. That’s right for a domain split between this server and another. Turned on by mistake, those messages bounce later, often to forged senders.',
         action: {
           kind: 'review',
           viewName: 'x:Domain',
-- 
2.54.0