Relaying problem!!

[Guest_imported]

I am running exchange 5.5. In Routing Restrictions tab, I checked the two options: Hosts and clients that succesfully authenticate AND Hosts and clients with these IP_address options. I left the text area below the second option empty.
I thought this should prevent relaying. But every morning if I look at my IMS outbound messages queue, I see spam mails waiting for delivery. I usually delete them manually. Is my server being used for relaying? Is that queue mean relaying work or few spams get through? Thanks

SN

 

[julianf]

Hi,

All I have done is checked the top box under routing..."Hosts and clients that succesfully authenticate "...that is sufficient. Remove the other one...unless you want to specify certain IP's.

Also, remember that you MUST restart the internet mail service, or the change wont take place.

Just becuase you can see suspicious looking entried inside the delivery queue, it does not mean that you are being spammed...I read in one of the threads something about seeing message with <> as the sender....and it turned out to be pretty harmless....

Cheers

Jules

 

[devastator]

The <> originator is usually your Exchange Server trying to send a notification to a sender that no such recipient or mailbox exists. Just check your mail logs. Most of the time they sit in the que because the return address is that of a spammer and of course the address is a fake.

Try this site for testing.....

http://www.abuse.net/relay.html

Remember that if it fails it will test to see if your mail server protects against %?@ type emails. Can't remember the correct term for those types of emails. Something like relaytest%abuse.net

 

[khurramriaz]

The option of users that successfully authenticate is ok, Remove the other
one...unless you want to specify certain IP's.
Also i am sending you the link to check for relay, if your relay is controled you can
also remove the abusing list from this particular link.

http://work-rss.mail-abuse.org/cgi-bin/nph-rss

Thanks

 

[Mfink22]

Checking the &quot;Hosts and clients with these IP_address options&quot;, does provide increased security against relays. By checking this box, the server will respond with the 550 relaying not permitted.

Here are a couple links that will explain in better detail:

http://www.exchangeadmin.com/Articles/Index.cfm?ArticleID=7696

http://www.microsoft.com/technet/tr...chnet/security/prodtech/mailexch/excrelay.asp

The first link also gives an explaination on how to test your server for relay.

You can also have it tested at

http://www.ORDB.org