InfoSysNetworks
asked on
Why is Exchange 2010 Queue Viewer showing multiple "No Sender <>" items that can't be delivered?
Microsoft Exchange 2010 server has been setup behind a Cisco Internet router with ACLs. Originally SMTP connections were allowed from any host on the Internet and a few other things may have been mis-configured. This resulted in the public IP address being listed on backscatter.org. Now obviously some domains are not accepting the connection attempts. The client is configured to have mail go through Postini first and now the router ACL has been reconfigured to only accept port 25 connections from Postini's public range. I have tested this from Postini's web console and it is working. Why is the server still trying to send out "Undeliverable" messages from no sender with obvious spam in the subject. I am aware that other messages are in there because we are on the blacklist. What is the best way to troubleshoot this? I have been manually clearing out the messages an not sending an NDR.
Thanks.
Thanks.
vanbarsoun
I would freeze the outbound queue first, then look at one of the outbound spam emails and check its internet headers. You'll have to actually open the file in the queue with notepad. This should tell you where the emails are originating, i.e. if somehow you're still an open relay or if there's an internal client that's infected and sending these out.
ASKER
I have disable the Exchange 2010 outbound send connector. I don't see how to view the details of messages in the queue (the Internet headers) or open them in notepad. Port 25 is only open to the spam filtering company to deliver "clean" mail, so I don't think it would be an open relay. I am able to do external DNS lookups from the Exchange server using nslookup. I don't have any smarthost configured and I am just using external DNS for MX lookups.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.