Die Evil Spammers! HELP!

[Don]

OK. I have a SBS Exchange Server 2003. Lord knows why but it turns out that for a while it was an "Open Relay" - ouch ouch ouch.

I have read the Microsoft site. I have implemented even more draconian rules than they recommend (I think!)

But being an IT pro - but not an e-mail one I am finding it hard to be certain that the EVIL SPAMMERS (die die die) can no longer use the machine.

In fact - the poor old girl is creaking under the load of "550 Unauthorised ..." etc that its putting out.

What am I doing wrong? I thought if I "closed" the relay (denied access to all machines etc) then the damn spam wouldn't even appear in my queues...but it still does! I've got maximum logging turned on so I know thousands and thousands of messages are getting a RCPT error...but I don't know if I've "killed" then or if they are going on somewhere.


I hate SPAM with a vengeance. Any advice from Exchange Gurus very, very, very much appreciated!

[_Dobbo_]

Not an exchange server guru but do know my stuff about email so I'll take a shot in the dark.

Assuming your server is locked down to relay, it should generate a "550 relay not allowed" error (or some such) during the actual SMTP transaction.

The problem might be that exchange may infact accept the mail, then generate a failure email saying "550 relay not allowed" - hence all the mails in your queues. If this is the case I'm sure it's configurable.

Just a guess as I mentioned but could be a possibility.

[_Dobbo_]

Oh, by the way, if you want to email me your server IP address through my profile I'll be happy to connect to see if it is indeed doing this.

[malman]

Get the server tested for relay
www.abuse.net/relay.html

Make sure you are not in any blacklists
www.moensted.dk/spam/
that link checks most of them

It should be logging 550 unable to relay in the smtp logs but are your outbound queues full of mail?

Is this the Microsoft article you used?
http://support.microsoft.com/default.aspx?scid=kb;en-us;324958

[ErnestM]

Don...

Disable NDR in exchange (non delivery response message)...

Chances are, you're quing up messages for NDR delivery to the evil spammers (Die, Die, Die - indeed) and the messages aren't going anywhere due to the fact that the sending address is bogus. Exchange actually tries to deliver the NDR as diligently as it does regular mail...

ALSO

Don't know if it will work on SBS Exchange, but I have always had good luck with GFI's mail essentials - www.gfi.com - stops all sort of spam and has a learning mode so it does not block good email...

Cheers

ErnestM

[Don]

Thanks again chaps.

malman - yes that was the article - Dobbo kindly checked that we're not an open relay - we're not (we were ) - I will disable NDR when I get into the office, thanks Ernest.

[_DeeJay_]

Don said:

Thanks again chaps. malman - yes that was the article - Dobbo kindly checked that we're not an open relay - we're not (we were ) - I will disable NDR when I get into the office, thanks Ernest.

The exchange server should not generate NDR's if all the spammers are doing if the server is nolonger an open relay.

If you're getting mail addressed to _your_ users then I can understand it (because the source address will be bogus).

However, if they're attempting to use your server to Spam others they won't get as far as generating an email (so no NDR's)

Darren