We have an exchange 2003 server (SBS 2003) behind a dedicated ISA 2004 firewall. For some reason our outbound email has been getting more and more delayed as of late. I started digging around and found that the Mailroot/vsi 1/Queue folder has about 15MB or 800+ email messages in it.
In opening up some of these messages, they are being addressed from 'postmaster@<ourdomain>.co
Could anyone out there point me at some configuration issues that might be a factor? Public IP Address is 72.240.120.108.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Update: I was reading some Microsoft KB articles on relaying and examining my SMTP Virtual Server settings and found the following which I have removed/disabled:
On the Access tab and in the Relay settings, I removed the 127.0.0.1 entry along with unchecking the box for "Allow all computers which successfully authenticate to relay, regardless of the list above".
do you have "only the list below" or "all except the list below" checked?
you should have "only the list below" and the lan ip of your exchange server in the list.
127.0.0.1 is localhost which is your server. so it was ok that was in there.
however-you were an open relay b/c you had that "allow all computers....." option checked....
as a result your ip is on a blacklist..... http://tqmcube.com/
http://mxtoolbox.com/black
you'll have to contact them to get off.
opie,
I do have the "only the list below" with the IP address (mask 255.255.255.0) of my internal network. However, I am still getting a Queue list increase (up to mail 29 queues and 20+ emails in Queue folder) in the past hour of making those changes - we are only three people in this office and very little email traffic. I reduced number of connections from 500 to 50 and the connection time-out from 10 minutes to 1 minute.
If the messages are postmaster@ then that is NDR spam. You can stop that with recipient filtering.
http://www.amset.info/exch
To clean up the queues see my article here: http://www.amset.info/exch
I don't see the IP address blacklisted in any of the major blacklists...
http://www.robtex.com/rbl/
Simon.
hmmm, i thought since the ndrs were being sent by his server that it was a result of the open relay, not an ndr spam attack. Doesn't an ndr of a spam attack come from the recipient's server?
i've got the recipient filter applied and our server stills get ndr spam. I did not however increase the tarpit time.
ok, another comment -
if it is his server that is sending the ndrs--wouldn't the recipient's servers be the ones who have to apply the recipient filtering to avoid his ndrs?
that is why i thought the only thing he had to do was close the open relay..?
he should do the recipient filtering and up the tarpit time so that his server doesn't "get a taste of its own medicine".
thanks
Let me clarify what has happened here, because there appears to be some misunderstanding.
NDR spam is where emails are sent to your server with invalid addresses at your domain, on purpose. The server accepts those messages in a default configuration and then attempts to deliver them back to the sender. The sender is spoofed and is the real target of the spam.
Spammers lists are not very clean, so the messages that you are seeing in the queues are messages that failed - invalid addresses etc. A lot more email will have gone out, where the addresses were valid.
The messages will eventually be dropped by Exchange because of the timeouts on the SMTP virtual server. Usually after 48 hours.
Recipient filtering stops NDR spam in its tracks. The Exchange server rejects the message at the point of delivery, so the spammer cannot send messages through your server. However you need to configure the tarpit time to ensure that the server is not exposed to directory harvest attacks.
Simon.
Business Accounts
Answer for Membership
by: weinstein_joshPosted on 2007-08-21 at 12:07:52ID: 19740563
Further update: one open relay test says that it appears to accept message relay but isn't a positive open relay.