GPadmin
asked on
Exhange spoofing of server behiind firewall.
I'm running an exchange server and hosting e-mail on a server via a port redirect on the router. The MX records point at the public IP of the router.
I'm getting some, not many but still some NDR's from remote servers telling me that the mail was not delivered. Of course the e-mail did not originate from my users or server. I have eliminated the possibility of a mail bot on the users computer and believe it to be a domain spoofer.
What would be the suggested action to take, to protect from domain spoofing if my server is not authoritative to the domain it is sending email from?
I'm getting some, not many but still some NDR's from remote servers telling me that the mail was not delivered. Of course the e-mail did not originate from my users or server. I have eliminated the possibility of a mail bot on the users computer and believe it to be a domain spoofer.
What would be the suggested action to take, to protect from domain spoofing if my server is not authoritative to the domain it is sending email from?
We get NDR's all the time, some are rough spam (as NDR's mostly passes through filters). That's the world we built and we have to live with it. Any spammer (anyone) can put your address as the reply address in any message.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Good Behaviour: On an Exchange Server, enable Recipient Filtering and turn on the Tarpit Feature
Be careful about blocking backscatter from your machine. You'll probably get nailed to the wall for violation of RFC 3461 and 2821 if rfc-ignorant catches on.
Recipient filtering will disable the NDR, handling the communication on a SMTP level and thus evading the need for sending an NDR as the message did not reach the mail server. It's Brilliant. Combined with the Tarpit Feature we're not ahead of the spammers but at least saying No !
ASKER
I will look into this and see what happens, thanks
As long as this isn't a mailbot within your network, you should be okay. Rarely do domains get abused like that to the point of getting RBL'ed, unless you've actively irritated a spammer.