exchange 16 open relay

Dan
Dan used Ask the Experts™
on
How do I close my exchange server from being an open relay.  I am running exchange 16, and earlier today, i thought it was configured to NOT be an open relay.
I since made a lot of changes today and when I just checked, looks like I'm an open relay.  I'm sure it's some permissions issue in one of the connectors, I just
don't remember which one.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
DanNetwork Engineer

Author

Commented:
I'm confused, why these discrepancies?
https://www.adminkit.net/smtp.aspx
This place says  "550 relay not permitted"

http://www.spamhelp.org/shopenrelay/shopenrelaytest.php
This place says "error, could not connect to server"

https://mxtoolbox.com/SuperTool.aspx?action=smtp%3
This place says "SMTP server disconnected, may be an open relay"


https://www.wormly.com/test-smtp-server
This place says "Message completed successfully.", and I do get the test email.

So who do I trust?
Fractional CTO
Distinguished Expert 2018
Commented:
Dan, at this point in time, all MTAs (including Exchange) default settings disable open relaying.

To create an open relay, you'd have to configure your MTA to allow this.

If you're running with defaults, you're closed to relaying.
DanNetwork Engineer

Author

Commented:
Got it, but concern is that in the past, I don't remember if I made any changes to the default connectors.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

DanNetwork Engineer

Author

Commented:
what's the best way to check if any of my settings allow for open relaying?
timgreen7077Exchange Engineer
Distinguished Expert 2018
Commented:
see the below link for the default receive connector settings for exchange 2016. compare your receive connectors to the default settings. just a note if you configured a custom relay for internal relaying based on IPs of course those connector will not show.

https://docs.microsoft.com/en-us/exchange/mail-flow/connectors/receive-connectors#default-receive-connectors-created-during-setup
AmitIT Architect
Distinguished Expert 2017

Commented:
Just send an email using PS script from any member server. If it fails, then you don't have open relay.
DanNetwork Engineer

Author

Commented:
internally, I could send an email, so I know it's open internally.
AmitIT Architect
Distinguished Expert 2017

Commented:
From member servers?
DanNetwork Engineer

Author

Commented:
from my own computer, does it make a difference if I run the telnet command from a server or my PC?
David FavorFractional CTO
Distinguished Expert 2018

Commented:
To test for open relays, there are many online tools for this.

https://mxtoolbox.com/diagnostic.aspx is one common tool for this.
AmitIT Architect
Distinguished Expert 2017

Commented:
If you are using script for testing and not passing any credential, And client IP is not added in relay connector, then you have open relay.
DanNetwork Engineer

Author

Commented:
David:
I used mxtoolbox before numerous times, this is what I get that fails:
      SMTP Server Disconnected      May be an open relay
But I used 3 other sites, and they all said that it's not an open relay, not sure what to believe.

Amit:
I did not use a script, I just manually did a telnet IP 25
Then just entered sending email, rcpt email, the message and sent.  
I did receive the email, so I know internally, it's an open relay, was just trying to figure out it's an open relay externally.
AmitIT Architect
Distinguished Expert 2017
Commented:
Telnet is not the right way to test, As it will use your session to connect and send mail. You need to use script to send a test mail. Use this:

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010
Send-MailMessage -From yourmailid -To externalmailid -Subject test -SmtpServer serverip

Do it from member server. 99% you don't have open relay.
DanNetwork Engineer

Author

Commented:
I just double checked all the default connectors, and they were all fine, except one, it had the anonymous checked, unchecked it.
Same results on mxtoolbox.
AmitIT Architect
Distinguished Expert 2017

Commented:
Wait for sometime, and test again.
DanNetwork Engineer

Author

Commented:
So I waited a few days, and using wormly.com, it was still able to send a test message, so my system is an open relay  :(
All the default connectors are fine, so then I guess it means that one of my other connectors is the culprit, right?
DanNetwork Engineer

Author

Commented:
I just realized, wormly.com does not test for open relay, but just tests to see if email is working correctly, send a test email.

I used two other websites, and it can't connect, so I think I'm good.
DanNetwork Engineer

Author

Commented:
Thanks guys for your help.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial