Spoofed email addresses can send to Exchange 2000 Distribution Lists

No, it is a new feature for Exchange 2003.

http://www.microsoft.com/exchange/evaluation/features/default.asp
"Distribution lists restricted to authenticated users. You can allow only sending from authenticated users or specify which users can or cannot send mail to specified distribution lists. " 

Well, you can disallow your domain on the inbound email server.

Say you blocked *@yourdomain.com from being able to be a sending address from outside your org. Then when anyone spoofs the address, it would just get dropped. Are you using any kind of email filter tool?

D

Kidego

What type email filtering are you looking for? I have a Symantec Antivirus Gateway on the outside that scans for spam and viruses before it hits the mail server. I actually had thought of doing what you are saying out there. Guess I was hoping that Microsoft had a fix or something simple I had missed. Seems like a very large hole.

Under security for the distribution group there is a property called send to, just set it so only domain users/authenticated users can send to that mail address, therefore requiring authentication, and anything from the outside world will not be able to authenticate.

Timiano

Kidego,

In AD users and computers, find group, properties, security,....in the ACL Send to...make sure everyone doesn't have that permission, and restrict it to authenticated users/domain users, or similar group.

Timiano

and yes sorry, in E2k

cool, just asking. I need to build an E2K box for all the questions that get posted on it.... :)

D

I realize that I'm most likely a rookie compared to you guys, but I do have the security set as timiano has recommended. I am still finding that a user that is specified to be able to send to the DL doesn't have to be authenticated to be able to send to the list. Now this a distribution that was carried over from an Exchange 5.5 upgrade so maybe there is something there... I have run several tests and as long as the email address matches, it doesn't have to authenticate. From what I understand E2K3 does work that way.

If I'm wrong please correct me.

In the mean time I have done what Kidego recommended and it has corrected the problem The solution works, also cuts out all the spoofed garbage related to all these viruses that are flying around.

I'm okay with that solution, but if I can get E2K to do it properly I think that's a better solution. I'm just not seeing it.

Thanks guys

Exactly. It's a good way to keep out the crap. It resolves more than one issue. I'll bet if a user inside your network tried to send to that DL, unless they wer authenticated, it wouldn't send. That's because they are legit users, and are bound by the security.

D

Exactly, Local users can't send to it, unless they have the proper credentials.