Is Database Mail worth the risk / a standard practice I enabled Database Mail XPs and was testing it on my dev machine.  I was just wondering if the DB Mail is a bad security choice, and if it more secure (or standard practice) to send this kind of message via an application server (ColdFusion or PHP)?  I would be using the Database Mail for DB backup/restore messages, errors or error checking messages (that I can think of).  I am aware that enabling a feature always increases risk.

Using:


behind firewalls, etc..
Windows 2012 r2
MS SQL Server 2012
Exchange is on separate server
Using Windows Authentication
Enabled require secure connection


Thanks in advance.
While your question would probably be borderline duplicate of this one, I'm not real fond of the answer to the other question as it does not go into to much detail of the security risk.

Database mail is configurable to include who can use the profiles/accounts created. You have the following security measures when you enable Database Mail:

(Reference this answer by Thomas Stringer)


A public profile is only available to users in msdb database
Users of msdb database must also be member of DatabaseMailUserRole in order to execute `sp_send_dbmail


The one thing to consider outside of the above is with your application and the data you are allowing to be sent via email. For example, if you are making a generic function that will allow users to send a report either via Database Mail or your application; you need to ensure there is no sensitive data being sent (especially user data). It all depends if there are any security standards for your company or the industry you are in, if any extra measures need to be put in place. I know for some if a report is being sent it simply has to have disclosure notification on the report that maybe the user acknowledges whether there is sensitive data included. 

You may also add in security measures on your email system or Exchange that has policy where any email sent from the SQL Server instance or your application, can only go to internal email. It would not be allowed to send email to an outside domain name.

Is it worth the risk?

I would not consider it a risk at all based on the above information. It is a common tool used for any DBA (e.g. job failure notification, alerting, etc.) and can be a vital part of monitoring. I enable on an instance based on the need for support. Some environments it may not be preferred to setup on EVERY instance in your network (if large) and in that you may put it on an instance utilized for central monitoring.