Securing SMTP service

[verland]

My Exchange email service is currently being used illegitimately as a spam relay. This was noticed weeks ago, but we had problems getting the server itself to cut this out, so I modified the Raptors SNMP service properties (in the rule for our email) to only allow email to our domain.

That stopped a lot of spam and allowed us to fail (pass) some 17 relay tests.

However, we are still a relay. It is definately coming from the outside.



I want to try to lock down the SNMP rules a bit more but don't want to go clicking blindly, so what do these options in SMTP/advanced do?



Loose recipient checks

Loose sender checks



What I want to do is disallow users not using an internal email address to send email. We get messages in our Exchange IMC queue that are from <>.



Neither the online help nor the books we paid $4k for mention the SMTP advanced properties, and I don't even want to get into my call to tech support. Any help is appreciated, thank you.

Further note: we still fail (pass) email relay tests. As far as those go we are fine. But I've got laggy bandwidth and gobs of sniffer logs proving our email server is being abused.

 

[verland]

A bit of an update: I think a lot of our problems were caused when management decided to clean up a lot of old mailboxes by deleting them, w/o sandboxing the smtp addys. This causes the server to mail out tons of NDR's, waste bandwidth, communicate with spam servers and other spam-esque behavior.

I'm still curious what those options mean however if anyone knows, thanks!

 

[rene1000]

to prevent relaying via your server, do the following:

open your SMTP rule
click the services tab
select the smtp protocol
click configure
on the anti spam/relay tab, enter all recipient domains (all email domains used internally).

thats all

 

[rlee1]

also, under the SMTPD Anti Spam tab you can check the sender domain for spoofing and also use a black hole list to stop known spammers.

bl.spamcop.net and input.orbz.org will work with the blackhole list.

but the best method is to stop that Exchange box from relaying. the Exchange forum here has information on how to stop it.

 

[rene1000]

i prefer to stop the relaying at the firewall and not the mail server. this will block it before it reaches the mail server

 

[verland]

Thanks much for all the help.
I prefer to block them at both, but M$ tech support said we can't or else our IIS stuff won't work.

I tried deliberately breaking things with the IMS relay settings anyway, setting it to only allow clients from an impossible ip address and restarted the service. It would still relay; I guess that Routing Restrictions is just for looks....