Exchange 2007 Open Relay?

[skialta2008]

I have a new single server install of Exchange 2007 SP1 and appear to have an open relay. I can't determine how this could be since I followed the setup to the letter (as far as I could tell). This is the current security setting for the Receive Connector.

Default <machine name>:
The Network tab has all local IPv4 addresses set and 0.0.0.0-255.255.255.255 for the remotes.

Authentication is set at default.
The Permission group has all selected except for Partners.

Client <machine name>:
Network is the same except port, 587.
Authentication is set at the default.
Permissions are set for Exchange users only.


Any thoughts? I've made very few changes to the original config so I don't know if it truly is an open relay. Could it be a virus on a local system?

Thanks in advance

 

[58sniper]

You don't give details as to the problem.....

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[skialta2008]

There were over 200000 messages in the queue and since I haven't moved them from their ISP mail service to Exchange, I know this is not user generated.

 

[Davetoo]

But if they were in your receive queue, wouldn't you assume them to be spam instead of relay mail?

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[58sniper]

I would. Likely NDR spam if they are from postmaster @ your domain.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[skialta2008]

When I went to the Queue viewer, that is where I found all of the messages. I ended up stopping the Transport service, removed all of the files located at C:\Program Files\Microsoft\Exchange Server\TransportRoles\data\Queue and restarting the service. This was all outbound traffic, not inbound. Sorry if I indicated it was inbound. I had created one new Receive connector for an app to relay off but have since removed it. Otherwise, the receive queues are out of the box.

 

[skialta2008]

Any thoughts on this? I compared my settings to another Exchange 2007 server and I don't see any differences.