I have a Windows 2000 server with Exchange 2003 running on it. We currently use MXLogic to filter our inbound and outbound email. MXLogic informed us that we had an Open Relay and spam coming from our site. They shut down the outbound filtering until we are able to shut down the relay and now we are unable to figure out how to shut down the relay.
We have an SMTP connector set up to direct all outbound email to go from the Exchange server to MXLogic.
And our firewall directs all incoming SMTP traffic to our Exchange server.
MXLogic is able to telnet into our site and relay email.
Any ideas on how to turn off the open relay?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
You are behind a firewall (good). Ensure that your inbound SMTP Rules (TCP Port 25) will only accept inbound connections from MX Logic Servers (MX Logic can provide the list of subnets and servers for you to accept inbound connections from).
Configure your Default SMTP Virtual Server's "Relay Restrictions" to only allow relay from your internal subnets. (Exchange System Manager ->Servers->SERVERNAME->Pro
Configure your Default Recipient policy so that you only accept inbound e-mail for your own domains. (Exchange System Manager->Recipients->Recip
SJP
Check this one out.
http://www.petri.co.il/
Just read the warnings on the page as it may cause some new issues if not properly performed.
If your firewall has been locked down for MX Logic then you should still be able to carry out the telnet test from internally.
If you have allowed your internal subnet to relay, then that can cause an open relay condition as the traffic coming in from outside can be seen by the Exchange server as coming from the firewall instead.
Simon.
Configure your Default SMTP Virtual Server's "Relay Restrictions" to only allow relay from your internal subnets. (Exchange System Manager ->Servers->SERVERNAME->Pro
The "Only the list below" is checked but the list box is empty. Should I enter the internal subnet? How is that entered? Now that this is checked I cannnot receive email either.
Configure your Default Recipient policy so that you only accept inbound e-mail for your own domains. (Exchange System Manager->Recipients->Recip
There is a default policy set the allows email from our domain.
Most firewalls are not able to look at the email body, and when they do they often cause more problems than they fix.
The "Only the List Below" with a blank list is correct.
Do you send email out through MXLOGIC? If so, on the SMTP Connector make sure it isn't set to allow relaying for the domains listed above.
Simon.
If telnet is blocked and you have followed the above kb articles, you aren't an open relay. Ask them to please clarify. If there is still spam comming from your network, then one of your computers is probably infected with a virus (or an employee needs to be fired for hosting a spam server). If this is the case, just put a sniffer on your network, stop incomming and outgoing mail from exchange (I know, I know, but it needs to be done) and watch for SMTP traffic there are great software sniffers out there that will do this. If you find it, track down the ip and KILL! if you don't see any, then ask for some of the spam emails so you can atleast look at the headers and verify that your ISP knows what they are doing (you would be surprised at how bad some ISP's are). I would suspect there is a virus on your network if you are still sending spam.
Indeed, perhaps you should be looking for proof that you are an open relay.
Since you've verified the settings as suggested by other posts, have you even seen spam activity from your network?
Is it possible that it is not coming from your mail server at all but an infected workstation with its own smtp engine.
Am I being naive to consider this?
Business Accounts
Answer for Membership
by: redseatechnologiesPosted on 2007-06-14 at 22:00:14ID: 19289322
This guide from Sembee will show you how to test it out;
http://www.amset.info/exch
Let us know if you find (or dont find) anything odd
-red