Connection made for beefymailer: Why?

When viewing the application events on our Exchange 5.5 server l noticed we have many successful  connections with the following description.

Event Message

Source: MSExchangeIMC
Category: SMTP Interface Events
Event ID: 2003

A new TCP/IP SMTP connection has been made to host 10.5.80.105 (for beefymailer.net).  Logfile: L0000001.LOG

Our domain name is not beefymailer.net.  Our exchange server is suppose to only forward and receive email from our sendmail gateway at the IP shown.

What does the event indicate? and what does it mean?

Thanks,
Dave
LVL 1
dalvaAsked:
Who is Participating?
 
JasonBighamCommented:
http://support.microsoft.com/default.aspx?scid=kb;[LN];Q246580

"If diagnostic logging is enabled for the Internet Mail Service, this event will be generated for each outbound connection made by the IMC. If message archiving is enabled, the Logfile will indicate the location of the archived message."

Source of above comments: http://www.eventid.net/display.asp?eventid=2003
0
 
JasonBighamCommented:
Basically, it sounds like there was an outgoing email to that domain. but I'd triple-check everything to make sure you are not an open relay just to be safe... never hurts.
0
 
dalvaAuthor Commented:
Jason,
 
Actually your reference to MS KB Article Q246580 had the real answer.  It's a MS "feature" (bug).  

After the IMC is stopped and started, "the domain name for the first piece of mail that is forwarded to the specified host on the Connections tab will be used for each new Success Audit event 2003."

Thanks,
Dave
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.