Only test infrastructure you own or are authorized to assess.
A public inbound MX should accept recipients in domains it serves while refusing unauthorized relay to unrelated external domains.
Test from a network that is not implicitly trusted and without authenticating.
Compare:
- external sender -> your local recipient;
- external sender -> unrelated external recipient.
The first can be legitimate inbound mail. The second should not be accepted as unrestricted relay.
Do not actually deliver spam or use third-party recipients for the test.