Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is configuring Database mail and sending email using sp_send_dbmail considered a security threat?

share|improve this question
I can't think of one reason that would make it a security threat. – RK Kuppala Feb 29 '12 at 13:38
There stands in this document that: Because some system procedures interact with the operating system or execute code outside of the normal SQL Server permissions, they can constitute a security risk. System stored procedures such as xp_cmdshell or sp_send_dbmail are off by default and should remain disabled unless there is a reason to use them. – jrara Feb 29 '12 at 13:58
up vote 2 down vote accepted

Configuring DB mail is not a security risk. DB mail is disabled by default, This way, if you don't need DB mail, you are reducing the surface area of your SQL server. If you need to use DB mail, you can enable and start using it.

Xp_cmdshell is a bit more powerful and is better left disabled.

share|improve this answer

In a vacuum, any activated feature is an additional attack vector (or, additional "surface area" for the system). That said, I've never read or heard of any attack or exploit using DB Mail.

share|improve this answer
Yeah, but a really good exploit wouldn't be detected. I have to live with that hanging over my head every day. – Mike Sherrill 'Cat Recall' Feb 29 '12 at 17:21
Fair enough, but if it's never happened anywhere... I'd hate to not get email alerts of server problems due to fearing I'd be the first. The lack of incidents involving the feature makes the risk low enough in my mind to justify using it. Keeping the business moving is the higher priority in this case IMO. – Eric Higgins Feb 29 '12 at 17:29
"Fair enough, but if it's never happened anywhere..." But if it's a really good exploit, you wouldn't know it's never happened. The exploits we know about are the clumsy ones; the clumsy ones leave footprints. – Mike Sherrill 'Cat Recall' Feb 29 '12 at 17:52
I disagree with that. There are major non-profits (OWASP for example) that deliberately publish security exposures for the sake of putting white hats on to proper defense. All the major security providers do this, and it's a boon for an individual white hat to publish an exploit and how to protect from it before anyone else does. The idea that there is some secret knowledge that we have no hope of protecting ourselves from is not realistic. If you never walk out of the door of your house you'll reduce the chances of being run over by a bus, but there is value in going out of the door. – Eric Higgins Feb 29 '12 at 18:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.