cannot find spammer within network - sonicwall edge

[Prizmm]

I have a small office with 10 users. I hve a snicwall TZ180 on the edge and a windows domain running sbs 2003. Somehow we are getting blacklisted as a spammer and I am about to pull out my hair trying to find the source. I have sophos AV on all the machines and also gateway AV running on the sonicwall. I also am running Sophos puremessage to eliminate incoming spam. Any help would be appreciated. thanks!

Questions:
Could someone be using our exchange server as a relay?
I dont have IPS enabled yet, would that help?
I have a sonicwall rule in place to allow from WAN to LAN (.254 exchange server)SMTP for sending receiving email. Is that right?

 

[gavm99]

Start with the basics, go to

http://www.spamhelp.org/shopenrelay

from here you can check to see if your an Open Relay, let us know the results.

Thanks.

Gavin Moorhouse

http://www.lucidcomputersolutions.co.uk

Interested in my personal blog?

http://www.thelucidview.co.uk

 

[Prizmm]

thanks. I tested and found NO open relays. I worked on it all weekend and narrowed it down to one machine on the network. I went ahead and wiped that machine and I think I have fixed it. I also went into my sonicwall and added a rule to Deny all SMTP traffic from the lan to the wan except for the exchange server.