RE: Spam:Exchange 2003 SMTP security or NOT

From: "Dan Morentin" <DanM@xxxxxxxxxxxxxxxxxxxxxxxx>
To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
Date: Fri, 29 Oct 2004 10:35:05 -0700

Not from ndr's, but smtp engines running on network. Check outgoing logs




PERFORMANCE MATERIALS CORPORATION
Dan Morentin
Network Administrator
805-482-1722 x231
cell: 818-445-7834


-----Original Message-----
From: Vadim [mailto:vshulaev@xxxxxxxxxxxxxx] 
Sent: Thursday, October 28, 2004 17:10 PM
To: [ExchangeList]
Subject: Spam:[exchangelist] Exchange 2003 SMTP security or NOT

http://www.MSExchange.org/

Hi everyone,

I have Exchange 2003 in my domain. BE clustered and one FE server both
running Exchaneg 2003 Enterprise with SP1 and all of the Hotfixes and
updates on Win 2003 servers.

It is a second time my Public IP address ended up on Black List as a
Spammer or mail-relay. Did number of tests against my server for relay
and
it is all good when it comes to securing it. All of them behind PIX
firewall and it is very much closed to any SMTP other then this server.

I did come across the discussion on Microsoft site regarding this issie
and here is what got me thinking:

"Q: Exchange 2000 has been tested against relaying but still shows
random
(spam) domains in the SMTP queue. Logons shown as "system" or "SMTP" is
there a compromise I can't see with normal AV Scan?
A: Check your queues to make sure that your server is not sending an NDR
to the domain from where the email originated. I have this same issue on
my server where relaying is denied. However, if someone send an email to
nosuchuser@xxxxxxxxxx, Exchange will automatically attmpt to NDR back to
the originator. This does not indicate RELAY SPAM. Just NORMAL SPAM."

This is directly from Microsoft. I disabled NDR's on that server and
hopefully this would fix my issue with being a "spamer".

Anyone had any simular issues?

Thanks,

Vadim.

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist
Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com
Leading Network Software Directory: http://www.serverfiles.com
No.1 ISA Server Resource Site: http://www.isaserver.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this MSEXchange.org Discussion List as:
danm@xxxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe visit
http://www.webelists.com/cgi/lyris.pl?enter=exchangelist
Report abuse to listadmin@xxxxxxxxxxxxxx

RE: Spam:Exchange 2003 SMTP security or NOT

Other related posts: