While your question would probably be borderline duplicate of this one, I'm not real fond of the answer to the other question as it does not go into to much detail of the security risk.
Database mail is configurable to include who can use the profiles/accounts created. You have the following security measures when you enable Database Mail:
(Reference this answer by Thomas Stringer)
- A public profile is only available to users in msdb database
- Users of msdb database must also be member of
DatabaseMailUserRole in order to execute `sp_send_dbmail
The one thing to consider outside of the above is with your application and the data you are allowing to be sent via email. For example, if you are making a generic function that will allow users to send a report either via
Database Mail or your
application; you need to ensure there is no sensitive data being sent (especially user data). It all depends if there are any security standards for your company or the industry you are in, if any
extra measures need to be put in place. I know for some if a report is being sent it simply has to have disclosure notification on the report that maybe the user acknowledges whether there is sensitive data included.
You may also add in security measures on your email system or Exchange that has policy where any
email sent from the SQL Server instance or your application, can only go to internal email. It would not be allowed to send email to an outside domain name.
Is it worth the risk?
I would not consider it a risk at all based on the above information. It is a common tool used for any DBA (e.g. job failure notification, alerting, etc.) and can be a vital part of monitoring. I enable on an instance based on the need for support. Some environments it may not be preferred to setup on EVERY instance in your network (if large) and in that you may put it on an instance utilized for central monitoring.