Windows Forum

Ask something
Discussion Locked

SMTP spoofing...

0 helpful
7 replies

by stergios_nik

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello,

I have an Exchange 5.5 mail server with SP3.
I have blocked mail relaying by using the ROUTING option in IMS (reroute incoming SMTP mail).

I have enabled the option "Host and clients with these IP addresses" which performs routing restrictions. I have set specific IP address ranges that are allowed to route mails as inbound.

I thought that my problem was solved but keep seeing (in queue) that someone is sending email messages and the sender appears to be <> (none) while the destination goes to various sites...

I think that some of my users subscribed to an email list service of that spammers and they apply SMTP spoofing on my Exchange server using the user's email address.

I noticed that in the routing restrictions in IMS there is another option that is called: "Hosts and clients that succesfully authenticate" are allowed to reroute messages as inbound.

If I enable this option what is going to happen?

Any suggestions to my problem?

Thanks in advance.

7 replies

by beecee

This is from users having auto reply turned on.
-
go to the Internet Mail Service, select the Routing tab, and click "Do
not reroute incoming SMTP mail."
All of your internal clients will still be able to send their outbound mail and your CompuServe / ISP people can use the CompuServe / ISP relay servers.

You only need relay if you use POP / IMAP clients internally. If you're
using the Outlook client, you don't need it.

This may be spam, but then again it might not be. Many SMTP mails are sent
from <>. For example, all non-delivery reports, etc. are sent with a blank
sender address. (Generally, there's to "From:" information in the message
header, but it always uses <> at the SMTP level.) If you're not sure, turn
on the IMS logging so you can go in and open these mails to see exactly what
they are.

by curacao_dejavu

in addition previous answer.
re:Hosts and clients that succesfully authenticate" are allowed to reroute messages as inbound

If you enable that on clients that succesfully authenticate can send and receive email and setup their email clients to your smtp server and sent to a another emailadress that is not on your mailserver.
For example, they configure outlook express with the pop and smtp mailserversettings, then they can sent to a hotmail account to else they are restricted to only emailadress on the exchage server. (hope I was clear).
For it to function they have to enable in outlook express : My server requires secure authentication" (can not remember the exact term).

In addition I would suggest to install sp4, There was a problem with the way exchange handled the routing and that was solved in sp4.

regards,

Leopold

This discussion is closed to new replies.