The MTA Open Mail Relaying Allowed (thorough test) vulnerability when detected with a vulnerability scanner will report it as a CVSS 7.5.
CVSS is a scoring system for vulnerability systems, its an industry standard scoring system to mark findings against a specific number ranging from 0 to 10. They are shown as:
The vulnerability scan has detected that the remote SMTP server is insufficiently protected against mail relaying. This issue allows any spammer to use your mail server to send their mail to the world, thus flooding your network bandwidth and possibly getting your mail server blacklisted.
To disable the open relay:
Stop the Service for SMTP and your Mail Server
this allows you to delete the Queue folder completely that is located on the local drive of the server: C:\Inetpub\mailroot\Queue. (Once the SMTP service is restarted, the Queue folder will automatically get added)
From the server’s IIS Manager:
expand the mail node and access the properties of the ‘Default SMTP Virtual Server’
select the Access tab’s Authentication and Relay options
from the Authentication dialog box, remove the check box for ‘Anonymous access’ and then select Basic and Integrated authentications as shown here:
from the Relay Restrictions select only the Subnet of the environment to have access (If it is needed):
Restart the SMTP and Mail Server services