Software

Ask something
Discussion Locked

Am i being relayed

0 helpful
3 replies

by anthonyc

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

After doing some research on the net I thought I had my exchange server secured against mail relaying. This morning however I find this message in my inbox
?A mail message was not sent due to a protocol error.
572 Bounces are blocked due to systemabuse by spammers The message that caused this notification was:

To:
From: <>
Subject: Undeliverable: increased traffic generates sales
?

This scares the hell out of me. I someone using my server asa relay?
I run an WinNT Server with Exchange 5.5 SP3 behind a Firewall. What, other than the usual routing comnfigs in exchange can I do to protect myself and how can I tell if someone has used me a s a realay? Are there any monitoring tools out there to see if someone is abusing my server?
Thank you
Anthony

3 replies

by mckaytech

There are two issues here, really. Mail that really does get relayed through your server, and mail that only appears to have been relayed through your server. Proper configuration of your Exchange server can fully prevent the first but the second is far more difficult.

The best monitoring tool is probably going to be within Exchange server itself. If you turn up the diagnostic logging level in the Internet Mail Service, you'll capture information about relay attempts (and/or successes if the configuration is not right).

A firewall, by itself, is not much protection against spam relaying unless it has pretty highly developed Intrusion Detection capabilities or you are running a mail scanning program like Webshield along with it.It's a frustrating problem - spammers are slimy little dudes and have shown some pretty creative thinking...

paul

This discussion is closed to new replies.