Solved

Relay through POP3 connector

Posted on 2004-10-01
11
1,050 Views
Last Modified: 2008-06-07
I cannot see how this is hapenning but we seem to be relaying through the POP3 connector, that is large amounts of mail are arriving through the POP3 connector then being pushed straight out via the SMTP connector. We are running SBS 2000. I have posted a question about mail being pushed through our Exchange Server that is from Orange@event-support.co.uk and we have gone throgh the procedure for mail relay and confirmed that it is not relaying but the problem has arisen again but I have established that the mail is coming through the POP3 connector. Below is a copy of part of the POP3 log.

The SMTP session transcript was: <C>: RSET
<S>: 250 2.0.0 Resetting
<C>: MAIL FROM:<orange@event-support.co.uk>
<S>: 250 2.1.0 orange@event-support.co.uk....Sender OK
<C>: RCPT TO:<leanneh@massow.co.uk>
<S>: 250 2.1.5 leanneh@massow.co.uk
<C>: RCPT TO:<paul.martin@topmode.com>
<S>: 250 2.1.5 paul.martin@topmode.com
<C>: RCPT TO:<jeanc@traderman.co.uk>
<S>: 250 2.1.5 jeanc@traderman.co.uk
<C>: RCPT TO:<ian@studleyconservatories.co.uk>
<S>: 250 2.1.5 ian@studleyconservatories.co.uk
<C>: RCPT TO:<wosbirmingham@watches.co.uk>
<S>: 250 2.1.5 wosbirmingham@watches.co.uk
<C>: RCPT TO:<enquiries@sorion.co.uk>
<S>: 250 2.1.5 enquiries@sorion.co.uk
<C>: RCPT TO:<david@dsparchitects.com>
<S>: 250 2.1.5 david@dsparchitects.com
<C>: RCPT TO:<sales.bulpitts@talk21.com>
<S>: 250 2.1.5 sales.bulpitts@talk21.com
<C>: RCPT TO:<martinbanks@threeshades.com>
<S>: 250 2.1.5 martinbanks@threeshades.com
<C>: RCPT TO:<linda.winkley@bch.nhs.uk>
<S>: 250 2.1.5 linda.winkley@bch.nhs.uk
<C>: RCPT TO:<kr@kr-a.co.uk>
<S>: 250 2.1.5 kr@kr-a.co.uk
<C>: RCPT TO:<toshiabe@eu.meijicorp.com>
<S>: 250 2.1.5 toshiabe@eu.meijicorp.com
<C>: RCPT TO:<info@acunet.co.uk>
<S>: 250 2.1.5 info@acunet.co.uk
<C>: RCPT TO:<adam@allalloyslitting.fsnet.co.uk>
<S>: 250 2.1.5 adam@allalloyslitting.fsnet.co.uk
<C>: RCPT TO:<tonyjelley@broadsecurities.org>
<S>: 250 2.1.5 tonyjelley@broadsecurities.org
<C>: RCPT TO:<sales@namco-tooling.demon.co.uk>
<S>: 250 2.1.5 sales@namco-tooling.demon.co.uk
<C>: RCPT TO:<rogerneal@nealco.co.uk>
<S>: 250 2.1.5 rogerneal@nealco.co.uk
<C>: RCPT TO:<adivis@sterling.uk.com>
<S>: 250 2.1.5 adivis@sterling.uk.com
<C>: RCPT TO:<andy@newmangauge.com>
<S>: 250 2.1.5 andy@newmangauge.com
<C>: RCPT TO:<john@bphltd.co.uk>
<S>: 250 2.1.5 john@bphltd.co.uk
<C>: RCPT TO:<dalan@jacompany.co.uk>
<S>: 250 2.1.5 dalan@jacompany.co.uk
<C>: RCPT TO:<squallstar@compuserve.com>
<S>: 250 2.1.5 squallstar@compuserve.com
<C>: RCPT TO:<paul@beta-bks.com>
<S>: 250 2.1.5 paul@beta-bks.com
<C>: RCPT TO:<steve.coxon@btinternet.com>
<S>: 250 2.1.5 steve.coxon@btinternet.com
<C>: RCPT TO:<sue@jmbailey.co.uk>
<S>: 250 2.1.5 sue@jmbailey.co.uk
<C>: DATA
<S>: 354 Start mail input; end with <CRLF>.<CRLF>
<C>: { sending data from IStream... }
DATA
<S>: 250 2.6.0  <000c01c4a6fa$040e0900$0200000a@cambabest.local> Queued mail for delivery
0
Comment
Question by:Mark_Shuff
11 Comments
 
LVL 10

Expert Comment

by:munichpostman
ID: 12197992
Are you sure that these are not ndr's, generated by spam and viruses being sent to your domain to non-existent email addresses, which are then bouncing back out through your SMTP connector? This is quite common, the only solution to this is lockdown your environment to reject mails which are not sent to valid addresses in your organisation.
0
 
LVL 15

Expert Comment

by:scampgb
ID: 12198087
Hi Mark_Shuff,
The log you posted is an SMTP log, not POP3

From what the log says, your server is relaying these emails.

Is the address "Orange@event-support.co.uk" known to you?

I suggest that you check if you're mail server is an open relay - you can do this at http://www.abuse.net/relay.html
If your server is an open relay, you need to fix it pretty quickly :-)
0
 

Author Comment

by:Mark_Shuff
ID: 12199117
I have stopped NDR's last week and I have tested for relay and the server is not relaying. The mails are coming through the POP3 connector. The email address is unknown to me. The log is part of the POP3 process, I am not logging anything on the SMTP connector.

Mark
0
 

Author Comment

by:Mark_Shuff
ID: 12200542
I have just read that relaying is possible through SBS 2000 POP3 connector but there was no detail. Has anyone heard of this before?
0
 
LVL 15

Expert Comment

by:scampgb
ID: 12202026
I've not heard of POP3 being used to send emails before.  Can you please post the link to where you read this?

The log extract that you posted includes SMTP commands, not POP3 commands - so I'm a little confused.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 7

Expert Comment

by:jaguarpriest
ID: 12203099
It looks like your an OPEN SMTP relay.
0
 

Author Comment

by:Mark_Shuff
ID: 12206189
I have spoke to the people at orange@event-support.co.uk and they have told me that emails were sent out to a client list but any NDR were then re-hashed to create new addresses and a loop was then  established generating more and more mail. I am afraid I do not know anymore technical details about this only that the POP3 connector in SBS 2000 can be used to realy mail this was also the case in SBS 2003 but Microsoft has brought out a patch for this, http://www.microsoft.com/downloads/details.aspx?FamilyID=7b1ff109-092e-4418-aa37-a53af7b8f6fc&DisplayLang=en

To quote from this "There is a problem with how the POP3 connector processes certain messages downloaded from a POP3 server. This problem could result in the POP3 connector accidentally re-sending certain messages to recipients who are not part of the SBS server e-mail domain.
This may happen only in the cases where the POP3 connector is used to download mail from an external POP account. Customers using Exchange to host their mail internally will not experience this problem. This update resolves this issue.
"
I am going to use POPCON in future so that this problem does not re occur.

Thanks for your input.

Mark
0
 
LVL 15

Expert Comment

by:scampgb
ID: 12212268
Mark_Shuff,
How very interesting - sorry that I couldn't help with this.
I suggest that you post a message in Community_Support asking them to PAQ/Refund this question.
Remember to post a link to the question.
0
 
LVL 15

Expert Comment

by:scampgb
ID: 12219953
Lunchy,
I'm happy to PAQ/Refund :-)
0
 

Accepted Solution

by:
ee_ai_construct earned 0 total points
ID: 12258840
Question answered by asker or dialog valuable.
Closed, 500 points refunded.
ee_ai_construct (replacement part #xm34)
Community Support Admin
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
Following basic email etiquette rules will help you write a professional email and achieve a good, lasting impression with your contacts.
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now