Link to home
Start Free TrialLog in
Avatar of Mark_Shuff
Mark_Shuff

asked on

Relay through POP3 connector

I cannot see how this is hapenning but we seem to be relaying through the POP3 connector, that is large amounts of mail are arriving through the POP3 connector then being pushed straight out via the SMTP connector. We are running SBS 2000. I have posted a question about mail being pushed through our Exchange Server that is from Orange@event-support.co.uk and we have gone throgh the procedure for mail relay and confirmed that it is not relaying but the problem has arisen again but I have established that the mail is coming through the POP3 connector. Below is a copy of part of the POP3 log.

The SMTP session transcript was: <C>: RSET
<S>: 250 2.0.0 Resetting
<C>: MAIL FROM:<orange@event-support.co.uk>
<S>: 250 2.1.0 orange@event-support.co.uk....Sender OK
<C>: RCPT TO:<leanneh@massow.co.uk>
<S>: 250 2.1.5 leanneh@massow.co.uk
<C>: RCPT TO:<paul.martin@topmode.com>
<S>: 250 2.1.5 paul.martin@topmode.com
<C>: RCPT TO:<jeanc@traderman.co.uk>
<S>: 250 2.1.5 jeanc@traderman.co.uk
<C>: RCPT TO:<ian@studleyconservatories.co.uk>
<S>: 250 2.1.5 ian@studleyconservatories.co.uk
<C>: RCPT TO:<wosbirmingham@watches.co.uk>
<S>: 250 2.1.5 wosbirmingham@watches.co.uk
<C>: RCPT TO:<enquiries@sorion.co.uk>
<S>: 250 2.1.5 enquiries@sorion.co.uk
<C>: RCPT TO:<david@dsparchitects.com>
<S>: 250 2.1.5 david@dsparchitects.com
<C>: RCPT TO:<sales.bulpitts@talk21.com>
<S>: 250 2.1.5 sales.bulpitts@talk21.com
<C>: RCPT TO:<martinbanks@threeshades.com>
<S>: 250 2.1.5 martinbanks@threeshades.com
<C>: RCPT TO:<linda.winkley@bch.nhs.uk>
<S>: 250 2.1.5 linda.winkley@bch.nhs.uk
<C>: RCPT TO:<kr@kr-a.co.uk>
<S>: 250 2.1.5 kr@kr-a.co.uk
<C>: RCPT TO:<toshiabe@eu.meijicorp.com>
<S>: 250 2.1.5 toshiabe@eu.meijicorp.com
<C>: RCPT TO:<info@acunet.co.uk>
<S>: 250 2.1.5 info@acunet.co.uk
<C>: RCPT TO:<adam@allalloyslitting.fsnet.co.uk>
<S>: 250 2.1.5 adam@allalloyslitting.fsnet.co.uk
<C>: RCPT TO:<tonyjelley@broadsecurities.org>
<S>: 250 2.1.5 tonyjelley@broadsecurities.org
<C>: RCPT TO:<sales@namco-tooling.demon.co.uk>
<S>: 250 2.1.5 sales@namco-tooling.demon.co.uk
<C>: RCPT TO:<rogerneal@nealco.co.uk>
<S>: 250 2.1.5 rogerneal@nealco.co.uk
<C>: RCPT TO:<adivis@sterling.uk.com>
<S>: 250 2.1.5 adivis@sterling.uk.com
<C>: RCPT TO:<andy@newmangauge.com>
<S>: 250 2.1.5 andy@newmangauge.com
<C>: RCPT TO:<john@bphltd.co.uk>
<S>: 250 2.1.5 john@bphltd.co.uk
<C>: RCPT TO:<dalan@jacompany.co.uk>
<S>: 250 2.1.5 dalan@jacompany.co.uk
<C>: RCPT TO:<squallstar@compuserve.com>
<S>: 250 2.1.5 squallstar@compuserve.com
<C>: RCPT TO:<paul@beta-bks.com>
<S>: 250 2.1.5 paul@beta-bks.com
<C>: RCPT TO:<steve.coxon@btinternet.com>
<S>: 250 2.1.5 steve.coxon@btinternet.com
<C>: RCPT TO:<sue@jmbailey.co.uk>
<S>: 250 2.1.5 sue@jmbailey.co.uk
<C>: DATA
<S>: 354 Start mail input; end with <CRLF>.<CRLF>
<C>: { sending data from IStream... }
DATA
<S>: 250 2.6.0  <000c01c4a6fa$040e0900$0200000a@cambabest.local> Queued mail for delivery
Avatar of Member_2_1821405
Member_2_1821405

Are you sure that these are not ndr's, generated by spam and viruses being sent to your domain to non-existent email addresses, which are then bouncing back out through your SMTP connector? This is quite common, the only solution to this is lockdown your environment to reject mails which are not sent to valid addresses in your organisation.
Hi Mark_Shuff,
The log you posted is an SMTP log, not POP3

From what the log says, your server is relaying these emails.

Is the address "Orange@event-support.co.uk" known to you?

I suggest that you check if you're mail server is an open relay - you can do this at http://www.abuse.net/relay.html
If your server is an open relay, you need to fix it pretty quickly :-)
Avatar of Mark_Shuff

ASKER

I have stopped NDR's last week and I have tested for relay and the server is not relaying. The mails are coming through the POP3 connector. The email address is unknown to me. The log is part of the POP3 process, I am not logging anything on the SMTP connector.

Mark
I have just read that relaying is possible through SBS 2000 POP3 connector but there was no detail. Has anyone heard of this before?
I've not heard of POP3 being used to send emails before.  Can you please post the link to where you read this?

The log extract that you posted includes SMTP commands, not POP3 commands - so I'm a little confused.
It looks like your an OPEN SMTP relay.
I have spoke to the people at orange@event-support.co.uk and they have told me that emails were sent out to a client list but any NDR were then re-hashed to create new addresses and a loop was then  established generating more and more mail. I am afraid I do not know anymore technical details about this only that the POP3 connector in SBS 2000 can be used to realy mail this was also the case in SBS 2003 but Microsoft has brought out a patch for this, http://www.microsoft.com/downloads/details.aspx?FamilyID=7b1ff109-092e-4418-aa37-a53af7b8f6fc&DisplayLang=en

To quote from this "There is a problem with how the POP3 connector processes certain messages downloaded from a POP3 server. This problem could result in the POP3 connector accidentally re-sending certain messages to recipients who are not part of the SBS server e-mail domain.
This may happen only in the cases where the POP3 connector is used to download mail from an external POP account. Customers using Exchange to host their mail internally will not experience this problem. This update resolves this issue.
"
I am going to use POPCON in future so that this problem does not re occur.

Thanks for your input.

Mark
Mark_Shuff,
How very interesting - sorry that I couldn't help with this.
I suggest that you post a message in Community_Support asking them to PAQ/Refund this question.
Remember to post a link to the question.
Lunchy,
I'm happy to PAQ/Refund :-)
ASKER CERTIFIED SOLUTION
Avatar of ee_ai_construct
ee_ai_construct
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial