Exchange 5.5 mail relay 1

[Joelomatic]

I am wondering if I am suffering some sort of mail relay. I am not open as a direct SMTP relay per the TelNet message relay test. I am concerned because I see messages flowing through my e-mail queue which have no ORIGINATOR address listed. Although the following example shows a delivery failure, some seem to succeed.

Here is a sample of the log entries that are giving me this concern:

1:39:30 event ID 2001
Delivery of message from in temporary file 1LYL7MFG was attempted to host(s) 80.189.94.100 (for breathwk.globalnet.co.uk) with 0 recipients delivered and 1 undeliverable.

1:39:29 event ID 4031
The following message could not be delivered to <562slcom@breathwk.globalnet.co.uk>. The destination server reported: 550 Unknown local part 562slcom in <562slcom@breathwk.globalnet.co.uk> From: <> Subject: Undeliverable: 90% discounts on Microsoft, Adobe, Autodesk, Corel software! vxdcaixnttrw

1:39:28 Event ID 2003
A new TCP/IP SMTP connection has been made to host 80.189.94.100 (for breathwk.globalnet.co.uk). Logfile: <none>

1:39:20 Event ID 2002 A message from <562slcom@breathwk.globalnet.co.uk> in temporary file C:\EXCHSRVR\imcdata\in\1LYL7MF1 was received from cs671058-13.houston.rr.com with 1 local recipients.

 

[rdroske]

I've been told that the ones with no origionator are NDR's for the failed relay attempts.

Seems like everyone has them.

They bug me too because they get retried and retried.....

 

[yoshie]

There is a new ( well new to me as I have never had this before ) attack on mail servers happening now called a reverse NDR attack, where the spammer puts the recipients email adress into 'from'and nothiong into 'to' to use the ndr to send the spam to the person.
In the queue you will see the originator as <>.
I have been trying to get rid of this for 3 days now and have only found an application

http://www.cmsconnect.com/Praetor/

that seems to be able to stop the email getting in in the first place. I too have relaying stopped (from threads on this site) and pass all tests. More info on this reverse ndr attack can be found

http://www.cmsconnect.com/Praetor/W...ssage_tests/Thwarting_reverse_NDR_attacks.htm

Hope this helps you out.

Yosh

 

[rdurant]

Yosh,

This maybe far-fetched, but can you remember which threads you used to help stop relaying at your end?

Ryan

 

[yoshie]

even better rdurant here is a link to an FAQ to tell you exactly how to stop the relay.

http://www.tek-tips.com/faqs.cfm?spid=10&sfid=1779&newpid=10

 

[yoshie]

als have a look at this thread
thread10-764953 use advanced search and look for open relay.

a good place to test your relay is here

http://members.iinet.net.au/~remmie/relay/

it will just test and not list you if you happen to be open.

good luck and if you need a hand just ask.

 

[novistech]

try appriver.com its only $50/month but worth every penny of it. others will charge you and arm and a leg such as postini...etc.