NDR Attacks

1) yes, if you have followed the steps (as outlined here: http://www.petri.co.il/preventing_exchange_2000_2003_from_relaying.htm), you are fine. making telnet checks assures you that you can't relay. be also aware that if you were an open relay before, and somebody has exploited it, your server can be put in a list of open relays (http://www.ordb.org/) which will make certain domains, who check against this database, to reject your messages. you will need to contact the database admins and request removal from the list.

As for 5 connections, you might want to bring it up. Even in a small company environment with around 50-60 users, there are times when 5 connections is not enough for legitimate users.

2) You can't stop, but you can minimize incoming NDRs. The NDRs are sent to your server in two cases: either your server is used as an open relay - which you said you have closed; - or if the sender's address is forged as if it were sent from your server. You cannot prevent the second case, but you can do one step to minimize it: implement SPF. by adding a single DNS record to your dns servers, you can list all the servers who are allowed to send emails on your domain's behalf. Now this is not panacea, because it requires both you putting the record in your dns, and email recipient's server checking that dns record. But nowadays, more and more administrators implement SPF checks, and this number will increase in the future, plus most of the major free email services (which are the best target for spammers/trojan senders/etc) implement spf. To read more about SPF records, see this article: http://www.zytrax.com/books/dns/ch9/spf.html

To completely clean up the consequences of the incoming NDR attack, read this: http://support.microsoft.com/?kbid=909005

As for outgoing NDRs, yes, the checkbox to disable outgoing NDRs will suffice. Check yourself by loggin on to your free webmail (like hotmail) and sending an email to a nonexistent user in your domain. If nothing comes back, you're fine.

3) I have not completely understood your question. The rate of NDRs has decreased because you stopped the open relay, and whoever was sending messages from your server cannot do so anymore. What NDR features are you talking about anyway?


And the last, but the most important: get some 3d-party software to alleviate this. I would recommend GFI MailEssentials on the server (to stop spam) and GFI MailSecurity on the gateway virtual server (to stop NDRs, emails to nonexistent users and many other types of attacks). And they are very cheap - both of them you'll get under $1000 (depending on the size of your company, of course). you can get them at http://www.gfi.com