Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 233
  • Last Modified:

Strange messages in out queue

I have an Exchange Server 5.5 that gathers about 100 or so strange messages in the Outbound Awaiting Delivery queue every day in a slow trickle.

They look like spam or virus related things - they will have no originator and the destination is always some sort of loopy bs address like aaa5.8m.com, groogle.com, or the like.  They fail with a [network error during host resolution] message and just build up out there in the queue.  I have been purging them manually, but am concerned about their source.

We are not open relaying - everything requires authentication and I've been through the process of covering relay holes.  We WERE at one time open relaying and were being used for spam for about a month before I found it, several years ago.  I am also pretty confident that no one is purposefully using a mass mailer inside the building.  We are well antivirused, so I don't think someone is hosting a trojan innocently.

Can anyone help me identify the source of these messages and determine how to fix the root problem behind it?
0
breid7718
Asked:
breid7718
  • 2
1 Solution
 
getzjdCommented:
These are probably NDR's that spammers are using to send email now.  Turn off NDR's or you will have to use a 3rd party software solution.  Only exchange 2003 has the ability to filter out these emails automatically.  http://www.cmsconnect.com/  or I believe GFI mail essentials will help out also.

Read this to understand a reverse NDR attack http://www.cmsconnect.com/Praetor/RNDR/prRNDR.htm
0
 
breid7718Author Commented:
I can find Administratior notifications for NDRs (and have them turned off) on the IMS property page, but I don't see an option to actually turn off NDRs.  Where can I find that option?
0
 
getzjdCommented:
I was slightly off in saying to disable ndr's in exchange 5.5.  Sorry about that.. I have all my clients on 2k and 2k3 now so I didnt even think about it.

 This can only be done in 2000 and up.   Check out this thread http://www.tek-tips.com/gpviewthread.cfm/qid/655444/pid/10/lev2/3/lev3/15

There hare many suggestions in there.  Some of the filtering software can be found fairly cheap as well.  You may want to check those out.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now