Solved

Relay through POP3 connector

Posted on 2004-10-01
11
1,047 Views
Last Modified: 2008-06-07
I cannot see how this is hapenning but we seem to be relaying through the POP3 connector, that is large amounts of mail are arriving through the POP3 connector then being pushed straight out via the SMTP connector. We are running SBS 2000. I have posted a question about mail being pushed through our Exchange Server that is from Orange@event-support.co.uk and we have gone throgh the procedure for mail relay and confirmed that it is not relaying but the problem has arisen again but I have established that the mail is coming through the POP3 connector. Below is a copy of part of the POP3 log.

The SMTP session transcript was: <C>: RSET
<S>: 250 2.0.0 Resetting
<C>: MAIL FROM:<orange@event-support.co.uk>
<S>: 250 2.1.0 orange@event-support.co.uk....Sender OK
<C>: RCPT TO:<leanneh@massow.co.uk>
<S>: 250 2.1.5 leanneh@massow.co.uk
<C>: RCPT TO:<paul.martin@topmode.com>
<S>: 250 2.1.5 paul.martin@topmode.com
<C>: RCPT TO:<jeanc@traderman.co.uk>
<S>: 250 2.1.5 jeanc@traderman.co.uk
<C>: RCPT TO:<ian@studleyconservatories.co.uk>
<S>: 250 2.1.5 ian@studleyconservatories.co.uk
<C>: RCPT TO:<wosbirmingham@watches.co.uk>
<S>: 250 2.1.5 wosbirmingham@watches.co.uk
<C>: RCPT TO:<enquiries@sorion.co.uk>
<S>: 250 2.1.5 enquiries@sorion.co.uk
<C>: RCPT TO:<david@dsparchitects.com>
<S>: 250 2.1.5 david@dsparchitects.com
<C>: RCPT TO:<sales.bulpitts@talk21.com>
<S>: 250 2.1.5 sales.bulpitts@talk21.com
<C>: RCPT TO:<martinbanks@threeshades.com>
<S>: 250 2.1.5 martinbanks@threeshades.com
<C>: RCPT TO:<linda.winkley@bch.nhs.uk>
<S>: 250 2.1.5 linda.winkley@bch.nhs.uk
<C>: RCPT TO:<kr@kr-a.co.uk>
<S>: 250 2.1.5 kr@kr-a.co.uk
<C>: RCPT TO:<toshiabe@eu.meijicorp.com>
<S>: 250 2.1.5 toshiabe@eu.meijicorp.com
<C>: RCPT TO:<info@acunet.co.uk>
<S>: 250 2.1.5 info@acunet.co.uk
<C>: RCPT TO:<adam@allalloyslitting.fsnet.co.uk>
<S>: 250 2.1.5 adam@allalloyslitting.fsnet.co.uk
<C>: RCPT TO:<tonyjelley@broadsecurities.org>
<S>: 250 2.1.5 tonyjelley@broadsecurities.org
<C>: RCPT TO:<sales@namco-tooling.demon.co.uk>
<S>: 250 2.1.5 sales@namco-tooling.demon.co.uk
<C>: RCPT TO:<rogerneal@nealco.co.uk>
<S>: 250 2.1.5 rogerneal@nealco.co.uk
<C>: RCPT TO:<adivis@sterling.uk.com>
<S>: 250 2.1.5 adivis@sterling.uk.com
<C>: RCPT TO:<andy@newmangauge.com>
<S>: 250 2.1.5 andy@newmangauge.com
<C>: RCPT TO:<john@bphltd.co.uk>
<S>: 250 2.1.5 john@bphltd.co.uk
<C>: RCPT TO:<dalan@jacompany.co.uk>
<S>: 250 2.1.5 dalan@jacompany.co.uk
<C>: RCPT TO:<squallstar@compuserve.com>
<S>: 250 2.1.5 squallstar@compuserve.com
<C>: RCPT TO:<paul@beta-bks.com>
<S>: 250 2.1.5 paul@beta-bks.com
<C>: RCPT TO:<steve.coxon@btinternet.com>
<S>: 250 2.1.5 steve.coxon@btinternet.com
<C>: RCPT TO:<sue@jmbailey.co.uk>
<S>: 250 2.1.5 sue@jmbailey.co.uk
<C>: DATA
<S>: 354 Start mail input; end with <CRLF>.<CRLF>
<C>: { sending data from IStream... }
DATA
<S>: 250 2.6.0  <000c01c4a6fa$040e0900$0200000a@cambabest.local> Queued mail for delivery
0
Comment
Question by:Mark_Shuff
11 Comments
 
LVL 10

Expert Comment

by:munichpostman
ID: 12197992
Are you sure that these are not ndr's, generated by spam and viruses being sent to your domain to non-existent email addresses, which are then bouncing back out through your SMTP connector? This is quite common, the only solution to this is lockdown your environment to reject mails which are not sent to valid addresses in your organisation.
0
 
LVL 15

Expert Comment

by:scampgb
ID: 12198087
Hi Mark_Shuff,
The log you posted is an SMTP log, not POP3

From what the log says, your server is relaying these emails.

Is the address "Orange@event-support.co.uk" known to you?

I suggest that you check if you're mail server is an open relay - you can do this at http://www.abuse.net/relay.html
If your server is an open relay, you need to fix it pretty quickly :-)
0
 

Author Comment

by:Mark_Shuff
ID: 12199117
I have stopped NDR's last week and I have tested for relay and the server is not relaying. The mails are coming through the POP3 connector. The email address is unknown to me. The log is part of the POP3 process, I am not logging anything on the SMTP connector.

Mark
0
 

Author Comment

by:Mark_Shuff
ID: 12200542
I have just read that relaying is possible through SBS 2000 POP3 connector but there was no detail. Has anyone heard of this before?
0
 
LVL 15

Expert Comment

by:scampgb
ID: 12202026
I've not heard of POP3 being used to send emails before.  Can you please post the link to where you read this?

The log extract that you posted includes SMTP commands, not POP3 commands - so I'm a little confused.
0
Want to promote your upcoming event?

Are you going to an event? Are you going to be exhibiting at a tradeshow? Talking at a conference? Using a promotional banner in your email signature ensures that your organization’s most important contacts stay in the know and can potentially spread the word about the event.

 
LVL 7

Expert Comment

by:jaguarpriest
ID: 12203099
It looks like your an OPEN SMTP relay.
0
 

Author Comment

by:Mark_Shuff
ID: 12206189
I have spoke to the people at orange@event-support.co.uk and they have told me that emails were sent out to a client list but any NDR were then re-hashed to create new addresses and a loop was then  established generating more and more mail. I am afraid I do not know anymore technical details about this only that the POP3 connector in SBS 2000 can be used to realy mail this was also the case in SBS 2003 but Microsoft has brought out a patch for this, http://www.microsoft.com/downloads/details.aspx?FamilyID=7b1ff109-092e-4418-aa37-a53af7b8f6fc&DisplayLang=en

To quote from this "There is a problem with how the POP3 connector processes certain messages downloaded from a POP3 server. This problem could result in the POP3 connector accidentally re-sending certain messages to recipients who are not part of the SBS server e-mail domain.
This may happen only in the cases where the POP3 connector is used to download mail from an external POP account. Customers using Exchange to host their mail internally will not experience this problem. This update resolves this issue.
"
I am going to use POPCON in future so that this problem does not re occur.

Thanks for your input.

Mark
0
 
LVL 15

Expert Comment

by:scampgb
ID: 12212268
Mark_Shuff,
How very interesting - sorry that I couldn't help with this.
I suggest that you post a message in Community_Support asking them to PAQ/Refund this question.
Remember to post a link to the question.
0
 
LVL 15

Expert Comment

by:scampgb
ID: 12219953
Lunchy,
I'm happy to PAQ/Refund :-)
0
 

Accepted Solution

by:
ee_ai_construct earned 0 total points
ID: 12258840
Question answered by asker or dialog valuable.
Closed, 500 points refunded.
ee_ai_construct (replacement part #xm34)
Community Support Admin
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Utilizing an array to gracefully append to a list of EmailAddresses
"Migrate" an SMTP relay receive connector to a new server using info from an old server.
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now