Connection made for beefymailer: Why?

When viewing the application events on our Exchange 5.5 server l noticed we have many successful  connections with the following description.

Event Message

Source: MSExchangeIMC
Category: SMTP Interface Events
Event ID: 2003

A new TCP/IP SMTP connection has been made to host 10.5.80.105 (for beefymailer.net).  Logfile: L0000001.LOG

Our domain name is not beefymailer.net.  Our exchange server is suppose to only forward and receive email from our sendmail gateway at the IP shown.

What does the event indicate? and what does it mean?

Thanks,
Dave
LVL 1
dalvaAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JasonBighamCommented:
http://support.microsoft.com/default.aspx?scid=kb;[LN];Q246580

"If diagnostic logging is enabled for the Internet Mail Service, this event will be generated for each outbound connection made by the IMC. If message archiving is enabled, the Logfile will indicate the location of the archived message."

Source of above comments: http://www.eventid.net/display.asp?eventid=2003

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
JasonBighamCommented:
Basically, it sounds like there was an outgoing email to that domain. but I'd triple-check everything to make sure you are not an open relay just to be safe... never hurts.
dalvaAuthor Commented:
Jason,
 
Actually your reference to MS KB Article Q246580 had the real answer.  It's a MS "feature" (bug).  

After the IMC is stopped and started, "the domain name for the first piece of mail that is forwarded to the specified host on the Connections tab will be used for each new Success Audit event 2003."

Thanks,
Dave
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.