AH, all this time I was looking at the inetpub\mailroot\badmail directory. My client did not have many in his, and those that were there will all double bounces, meaning the returned message to a forged address and had no where to go. This grasshopper learns something new every day. Thanks. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -----Original Message----- From: Wohlgemuth, Mike [mailto:WohlgemuthM@xxxxxxxxxxxxxxxxxxx] Sent: Thursday, September 25, 2003 10:16 AM To: [ExchangeList] Subject: [exchangelist] RE: >>>>> Emergency ... Badmail directory and SMTP http://www.MSExchange.org/ Exchange does use the badmail folder go to the properties on your smtp server/messages , there is a badmail directory ... I couldn't find anything on deleting them except a problem with doing an upgrade to 2003 ... http://support.microsoft.com/default.aspx?scid=kb;en-us;822578 Mike -----Original Message----- From: John Tolmachoff (Lists) [mailto:johnlist@xxxxxxxxxxxxxxxxxxx] Sent: Thursday, September 25, 2003 12:47 PM To: [ExchangeList] Subject: [exchangelist] RE: >>>>> Emergency ... Badmail directory and SMTP http://www.MSExchange.org/ Have you bothered to check some of the messages in the badmail folder? Why do you have mail in the badmail folder? Exchange does not use that. How do you know you are not allow relaying? Have you reviewed the logs? How can you stop and start the SMTP service without Exchange screaming with errors? Sounds like you might have a couple of problems. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -----Original Message----- From: Joupin [mailto:me@xxxxxxxxxx] Sent: Thursday, September 25, 2003 9:26 AM To: [ExchangeList] Subject: [exchangelist] >>>>> Emergency ... Badmail directory and SMTP http://www.MSExchange.org/ <mailto:-1061702Q@xxxxxxxxxxxxx> Hi I have a serius problem in here there is an exchange server 2000 with sp3 on the windows 2000 (sp4) machine I notice a grow of BadMail directory unexpectly ( around 500,000 badmails just in a week . relay of the server were closed and nothing can be relay throw it . but when I just start the SMTP service suddenly lots of badmails flow in its directory and at the same time I don`t see any active current connection and the IP of source changed time to time using an sniifer no help ! Please let me know 1. Is it a kind of DoS Attack or spam ? so what can I do ? Any fast respond appreciated Regards Joupin www.joupin.com <mailto:-1061702Q@xxxxxxxxxxxxx> :confused: ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 ISA Server Resource Site: http://www.isaserver.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: johnlist@xxxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')