Exchange queues clogging

joshrosen
joshrosen used Ask the Experts™
on
I have a new 2007 exchange server. I am having alot of users complaining of delays in the SMTP queue. When I look at the Queue viewer I see alot of messages with the from address <> which is delaying the sending of emails. Is there a way to see what IP address these are comming from. I suspect spyware but I do not know where to look?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Expert of the Quarter 2009
Expert of the Year 2009
Commented:
Highly unlikely to be spyware, as that doesn't send email through another server.
If you have lots of messages in the queues from <> then those are NDRs. It sounds like your server might be under an NDR attack. This is where messages are delivered to your server with invalid recipients on purpose - the idea being to have your server bounce the email back to the sender. The sender is spoofed and is the real target of the message.
What you need to do is enable recipient filtering, which is part of the antispam features.
http://www.amset.info/exchange/filter-unknown2.asp

Simon.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial