Open relay? Unauthorized outbound mail stuck in queues.

When I checked the outbound queues on our Exchange 6.5, there were 1500 outbound queues to various mail servers..... aaa.com, aaaa.com, aaaaa.com, etc.   The emails were definately not created by our organization, but list <community care> as the sendee.   The queues are all in "retry" states, and have been for several hours.   The protocols are all SMTP and the source is the Default SMTP virtual server.    

Checking the settings on our Default SMTP Virtual Server in Exchange, the relay restrictions list access only to our internal subnet ranges and "all computers which successfully authenticate".   We also have an IIS server with a smtp virtual server as well, and it has the same settings.    The only change we've made recently is to open the smtp server on the IIS to accept internal mail...i.e., from 192.168.25.x.  

Ideas?

---- update ----

We're now having emails refused, so it looks like we've been placed on a blacklist at spamcop.net.   The associated message on spamcop's site says, "DNS error: xx.xx.xx.xx is cdm-xx-xx-xx-xx.pars.cox-internet.com. but cdm-xx-xx-xx-xx.pars.cox-internet.com. has no DNS information" ... Is this related, and how do I resolve this?
itatahhAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

AdamRobinsonCommented:
See:

http://www.amset.info/exchange/smtp-relaysecure.asp
http://support.microsoft.com/kb/324958

After you get your problem taken care of, contact the Spamlists or RBLs and get yourself off them.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Michael FrederickRegional IT Manager IIICommented:
Yes, you need to fix the relay issue first. The links that AdanRobinson has supplied you should work on that. Then I would go to MXtoolbox and check the status. They will give you the info you need to get removed from the blacklist. I am regestered with them on a on going (free) service. They monitor my server 24/7 and notify me of outage or possible blacklist activity.

http://www.mxtoolbox.com/

Cheers
0
SembeeCommented:
The error you have shown from the blacklists is a DNS issue, not the spam issue.

For the DNS issue, put your domain in to dnsreport.com and see what it flags. It looks like you may have mismatched or no reverse DNS, compared to the forward DNS and server banner. dnsreport.com will show you if that is the case.

For the messages in the queues, you probably need my spam cleanup article.
http://www.amset.info/exchange/spam-cleanup.asp

Simon.
0
itatahhAuthor Commented:
Thanks - you 3 both aided in the solution.

AdamRobinson - the mail server was indeed an open relay; got that fixed.
Tekwazoo - helpful links.
Sembee - our reverse DNS was pointing to our ISP, not our mail server....partially solved now - thanks for the pointer....but that opens some other questions that I'll post in another ticket.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft IIS Web Server

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.