Floods of undeliverables

[hunterdw]

Yeah, you know the story. Tons of NDRs are being sent to all of my users. They are the typical spam-like emails that they haven't sent... but they get the NDRs.

How can I trap them and have them all sent to ONE email address - me. I'll deal with them so my users quit freaking out.

Exchange 2003 Enterprise SP2
150 users
27GB Mailstore

Thanks,

--DW

 

[JoeLan]

Under connectors in ESM right click SMTP Virtual Server go to properties and the the messages tab place your email address or one created for the NDRs under "Send a copy of non-delivery report to:"

This should fix it

Joe

 

[hunterdw]

Did that. That just gave me a "copy" but was still giving the DNRs to the users.

I restarted SMTP. I restarted server. Still no change.

By the way, tons is a relative term.

For me, that means I get about 400 of them a day. That's tons ot me. MAybe not to some higher volume places. But, 400 is hard to wade through, and my users are getting 30-50 average...

--DW

 

[Davetoo]

The problem is these are not from your server but from outside mail servers. It's going to be hard to trap the false ones and still let real ones through.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.
The poster formerly known as lander215

 

[hunterdw]

Right. I've heard about creating a "catchall" or whatever, but don't seem to really understand what that means.

More background... this server was recently reformatted / reinstalled. Before the change, all was well. No NDR flood. Something was catching it all.

I just can't figure out what.

I just took over a few months back, and didn't have a great handoff, so any configs/setup information was not given to me, so when I blew away the server, I'm sure I lost something.

If it were YOU and you wanted to catch all NDRs, what product/service/setup would you recommend?

--DW

 

[blakey2]

Hmm, your server is definately closed for relaying (post reinstall)?

I'd dbl check that before anything else..

 

[hunterdw]

Yup, definitely closed relay.

Only relays authenticated from internal 10.x network and my 2 whitelisted webservers.

--DW

 

[blakey2]

We use GFI Mail Essentials as our antispam solution.
Pretty sure there is an option to enable/disable NDR's.. I can have a look see if required.

Cheers.

 

[hunterdw]

That would be great.

I'm not against buying GFI... if there's an option in there, that'd be awesome. I just don't want to waste money if it won't fix the problem.

We're non-profit no budget gets tricky at the end of the year

--DW

 

[blakey2]

Hi Hunterdw,

Apologies - went to chk then got busy busy till now. I can't seem to find an explicit option though I thought that there was one there - perhaps I was thinking of disabling automatic replies to the internet?

In any case you should be able to download a one month trial of GFI Mail Essentials from their website.

http://www.gfi.com

There is certainly the ability to filter based on keyword / subject and I'm pretty sure you could put in relevant phrase to stop all NDR's.

Apologies for lack of info - i'm off to a music festival for the w/e!

Cheers

 

[hunterdw]

No worries. Thanks. I'll see what I can find.

--DW