Go Premium for a chance to win a PS4. Enter to Win


Relay through POP3 connector

Posted on 2004-10-01
Medium Priority
Last Modified: 2008-06-07
I cannot see how this is hapenning but we seem to be relaying through the POP3 connector, that is large amounts of mail are arriving through the POP3 connector then being pushed straight out via the SMTP connector. We are running SBS 2000. I have posted a question about mail being pushed through our Exchange Server that is from Orange@event-support.co.uk and we have gone throgh the procedure for mail relay and confirmed that it is not relaying but the problem has arisen again but I have established that the mail is coming through the POP3 connector. Below is a copy of part of the POP3 log.

The SMTP session transcript was: <C>: RSET
<S>: 250 2.0.0 Resetting
<C>: MAIL FROM:<orange@event-support.co.uk>
<S>: 250 2.1.0 orange@event-support.co.uk....Sender OK
<C>: RCPT TO:<leanneh@massow.co.uk>
<S>: 250 2.1.5 leanneh@massow.co.uk
<C>: RCPT TO:<paul.martin@topmode.com>
<S>: 250 2.1.5 paul.martin@topmode.com
<C>: RCPT TO:<jeanc@traderman.co.uk>
<S>: 250 2.1.5 jeanc@traderman.co.uk
<C>: RCPT TO:<ian@studleyconservatories.co.uk>
<S>: 250 2.1.5 ian@studleyconservatories.co.uk
<C>: RCPT TO:<wosbirmingham@watches.co.uk>
<S>: 250 2.1.5 wosbirmingham@watches.co.uk
<C>: RCPT TO:<enquiries@sorion.co.uk>
<S>: 250 2.1.5 enquiries@sorion.co.uk
<C>: RCPT TO:<david@dsparchitects.com>
<S>: 250 2.1.5 david@dsparchitects.com
<C>: RCPT TO:<sales.bulpitts@talk21.com>
<S>: 250 2.1.5 sales.bulpitts@talk21.com
<C>: RCPT TO:<martinbanks@threeshades.com>
<S>: 250 2.1.5 martinbanks@threeshades.com
<C>: RCPT TO:<linda.winkley@bch.nhs.uk>
<S>: 250 2.1.5 linda.winkley@bch.nhs.uk
<C>: RCPT TO:<kr@kr-a.co.uk>
<S>: 250 2.1.5 kr@kr-a.co.uk
<C>: RCPT TO:<toshiabe@eu.meijicorp.com>
<S>: 250 2.1.5 toshiabe@eu.meijicorp.com
<C>: RCPT TO:<info@acunet.co.uk>
<S>: 250 2.1.5 info@acunet.co.uk
<C>: RCPT TO:<adam@allalloyslitting.fsnet.co.uk>
<S>: 250 2.1.5 adam@allalloyslitting.fsnet.co.uk
<C>: RCPT TO:<tonyjelley@broadsecurities.org>
<S>: 250 2.1.5 tonyjelley@broadsecurities.org
<C>: RCPT TO:<sales@namco-tooling.demon.co.uk>
<S>: 250 2.1.5 sales@namco-tooling.demon.co.uk
<C>: RCPT TO:<rogerneal@nealco.co.uk>
<S>: 250 2.1.5 rogerneal@nealco.co.uk
<C>: RCPT TO:<adivis@sterling.uk.com>
<S>: 250 2.1.5 adivis@sterling.uk.com
<C>: RCPT TO:<andy@newmangauge.com>
<S>: 250 2.1.5 andy@newmangauge.com
<C>: RCPT TO:<john@bphltd.co.uk>
<S>: 250 2.1.5 john@bphltd.co.uk
<C>: RCPT TO:<dalan@jacompany.co.uk>
<S>: 250 2.1.5 dalan@jacompany.co.uk
<C>: RCPT TO:<squallstar@compuserve.com>
<S>: 250 2.1.5 squallstar@compuserve.com
<C>: RCPT TO:<paul@beta-bks.com>
<S>: 250 2.1.5 paul@beta-bks.com
<C>: RCPT TO:<steve.coxon@btinternet.com>
<S>: 250 2.1.5 steve.coxon@btinternet.com
<C>: RCPT TO:<sue@jmbailey.co.uk>
<S>: 250 2.1.5 sue@jmbailey.co.uk
<S>: 354 Start mail input; end with <CRLF>.<CRLF>
<C>: { sending data from IStream... }
<S>: 250 2.6.0  <000c01c4a6fa$040e0900$0200000a@cambabest.local> Queued mail for delivery
Question by:Mark_Shuff
LVL 10

Expert Comment

ID: 12197992
Are you sure that these are not ndr's, generated by spam and viruses being sent to your domain to non-existent email addresses, which are then bouncing back out through your SMTP connector? This is quite common, the only solution to this is lockdown your environment to reject mails which are not sent to valid addresses in your organisation.
LVL 15

Expert Comment

ID: 12198087
Hi Mark_Shuff,
The log you posted is an SMTP log, not POP3

From what the log says, your server is relaying these emails.

Is the address "Orange@event-support.co.uk" known to you?

I suggest that you check if you're mail server is an open relay - you can do this at http://www.abuse.net/relay.html
If your server is an open relay, you need to fix it pretty quickly :-)

Author Comment

ID: 12199117
I have stopped NDR's last week and I have tested for relay and the server is not relaying. The mails are coming through the POP3 connector. The email address is unknown to me. The log is part of the POP3 process, I am not logging anything on the SMTP connector.

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.


Author Comment

ID: 12200542
I have just read that relaying is possible through SBS 2000 POP3 connector but there was no detail. Has anyone heard of this before?
LVL 15

Expert Comment

ID: 12202026
I've not heard of POP3 being used to send emails before.  Can you please post the link to where you read this?

The log extract that you posted includes SMTP commands, not POP3 commands - so I'm a little confused.

Expert Comment

ID: 12203099
It looks like your an OPEN SMTP relay.

Author Comment

ID: 12206189
I have spoke to the people at orange@event-support.co.uk and they have told me that emails were sent out to a client list but any NDR were then re-hashed to create new addresses and a loop was then  established generating more and more mail. I am afraid I do not know anymore technical details about this only that the POP3 connector in SBS 2000 can be used to realy mail this was also the case in SBS 2003 but Microsoft has brought out a patch for this, http://www.microsoft.com/downloads/details.aspx?FamilyID=7b1ff109-092e-4418-aa37-a53af7b8f6fc&DisplayLang=en

To quote from this "There is a problem with how the POP3 connector processes certain messages downloaded from a POP3 server. This problem could result in the POP3 connector accidentally re-sending certain messages to recipients who are not part of the SBS server e-mail domain.
This may happen only in the cases where the POP3 connector is used to download mail from an external POP account. Customers using Exchange to host their mail internally will not experience this problem. This update resolves this issue.
I am going to use POPCON in future so that this problem does not re occur.

Thanks for your input.

LVL 15

Expert Comment

ID: 12212268
How very interesting - sorry that I couldn't help with this.
I suggest that you post a message in Community_Support asking them to PAQ/Refund this question.
Remember to post a link to the question.
LVL 15

Expert Comment

ID: 12219953
I'm happy to PAQ/Refund :-)

Accepted Solution

ee_ai_construct earned 0 total points
ID: 12258840
Question answered by asker or dialog valuable.
Closed, 500 points refunded.
ee_ai_construct (replacement part #xm34)
Community Support Admin

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Are you an Exchange administrator employed with an organization? And, have you encountered a corrupt Exchange database due to which you are not able to open its EDB file. This article will explain all the steps to repair corrupt Exchange database.
Eseutil Hard Recovery is part of exchange tool and ensures Exchange mailbox data recovery when mailbox gets corrupt due to some problem on Exchange server.
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

877 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question