Behind the scenes, the commands sent to mail servers are simple text commands. These commands can be sent to an email server manually via Telnet. This is a quick way to test an email server to determine if it is an open relay.
First, determine the MX for the domain in question:
This should return something like such as the following:
mydom.com preference = 10, mail exchanger = mx.mydom.com
mydom.com nameserver = ns.mydom.com
mx.mydom.com.com internet address = 220.127.116.11
mx2.mydom.com internet address = 18.104.22.168
The last two lines tell you about the mail server (MX = Mail Exchange). In this case, 22.214.171.124 and 126.96.36.199.
So, armed with this knowledge, note the following examples:
telnet 188.8.131.52 25
Server responds with: 220 mx.mydom.com SMTP
Server responds with: 250 OK
Server responds with: 250 Address Ok.
Server responds with: 250 firstname.lastname@example.org OK
Server Responds (or may not): 354 Enter Mail
Enter message, and then on a new line, enter the following;
The message should now be sent. By modifying the MAIL FROM and RCPT TO lines, you can test for open relay.