Hi,
I am fairly new to Exchange and have been tasked with setting up a new SBS 2003 Server with Exchange for a client and am having some difficulties wth the SMTP Relay Authentication.
Currently the Relay is open with no authentication which is prone to attack from spammers.
If I turn off annoymous access to the relay whenever an email is sent from an external source to a user on the SBS Domain the sender gets the following error message bounced back:
----- The following addresses had permanent fatal errors -----
<firstname.lastname@domain
(reason: 550 5.7.1 Unable to relay for firstname.lastname@domain.
Now I know this is because I have currently set the Relay to "only use the following" and in the list below I have added no entries, in the Exchange System manager.
The problem I am having is I'm not sure which IP Address(es)/Domain(s) to put in the list to except as the problem is the emails coming from the big wide world NOT sending to it.
The only way around this is can see is to allow all connections to the Relay, which I have been told is potentially unsafe, as the IP address of the sender will vary from each person.
Can anyone please help, I have been searching for answers but most people seem to find the problem is outbound and mine is inbound.
Thanks in advance,
Mark
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
If you receive mail directly from other domains, you need to accept anonymous connections from everyone - however, you may be receiving all your mail from your ISP's mail server, in which case you can accept only connections from that one machine to reduce spam.
On the relay restrictions you want to except only from the list below, and specify your own internal IP range.
relay restrictions
So the Relay service only needs to be run if a user wishes to forward their email to the Exchange server on a different piece of hardware?
The problem is that I have setup Exchange on a SBS system without any extensive knowledge of Exchange and now am running into problems with receiving emails from external sources, which get bounced with the relay message above.
If I turn on 'No Username and Password' under the Relay option under Virtual SMTP under Exchange system manager the warning goes away and external emails are delivered to domain users.
I don't have enough understanding of how thisVirtual SMTP works.
Here's an example of relay:
I am at domain1.com, your are at yourdomain.com. I wish to send spam to johndoe@aol.com, however AOL no longer accepts mail from me. I send my mail message *from* domain1.com, *to* yourserver.yourdomain.com.
Every piece of *outbound* mail your users send is relay (because the mail server must accept a message destined for a domain it is not responsible for). Every *inbound* email message you receive from the internet should be destined for someone at your domain, and therefore not relay.
Relay settings do not affect that Exchange accepts messages for the domains it is responsible for (i.e. if I send a message to your server, for jdoe@yourdomain.com this is not a relayed piece of mail, therefore relay settings don't apply). Exchange knows which domains it is responsible for according to the SMTP addresses on the e-mail address recipient policies.
recipient policy
Did you use the wizard to configure Exchange? If not then that was your first problem. Rule number 1 with SBS - use the wizard.
Exchange is relay secure by default. It is not an open relay.
It will have authenticated relaying enabled, but if you do not have any POP3/SMTP clients then you can disable authenticated relaying. You also do not need any IP addresses listed for relaying.
Simon.
The problem with having the internal IP address listed is that some firewalls will make the traffic appear to be coming from an internal IP address. That can mean the server allows relaying from the internet - not due to any fault of its own.
I also work on the basis of having the server locked down as much as possible - open to relaying on an internal subnet is still too much for me - particularly on an internet facing SMTP virtual server. What I have done in the past is use a second SMTP virtual server for internal traffic - one that cannot be access from the internet.
Simon.
Hi All,
Thank you for your help on this matter.
What we did in the end was re-install SBS on the server and run through all the Wizards in the to-do list and it all worked fine.
Emails, exchange, dchp, dns, etc, etc were all setup automatically and after importing all the users mailboxes, my documents, etc, etc and reconnecting the clients to the domain it was fine.
Many Thanks,
Mark
Business Accounts
Answer for Membership
by: tgerbertPosted on 2008-04-15 at 08:26:02ID: 21359541
Relay means that a server will accept a message for a domain it does *not* own and forward it to the recipient's mail server, the only people who need to be able to relay are your own users.