Nope, Ive tried that. Actually I installed GFI Security on that server to help out. Blacklisting his adx doesn't help. It's a randomly generated sender (out of taiwan) I attached a copy of one (173 messages since I started this thread...) Doug -----Original Message----- From: Mark Fugatt [mailto:mark@xxxxxxxxx] Sent: Tuesday, May 27, 2003 10:42 AM To: [ExchangeList] Subject: [exchangelist] RE: stop the relay http://www.MSExchange.org/ Doug Do you know what email address he is using to try and sent the messages if you do then you could use the Message Filtering option in Exchange to not accept messages from his email address? Mark Fugatt MCT, MCSE, Microsoft Exchange MVP Pentech Office Solutions Inc Tel: 585 586 3890 Cell: 585 576 4750 Fax: 585 249 0316 www.4mcts.com www.exchangetrainer.com -----Original Message----- From: Stelley, Doug [mailto:dstelley@xxxxxxx] Sent: Tuesday, May 27, 2003 10:37 AM To: [ExchangeList] http://www.MSExchange.org/ OK, When we first setup our Exchange, we installed an SMTP server in our DMZ to handle inbound mail. We weren'r fast enough on protecting from relaying though and for about 4 hours on that day (early February), that SMTP server was open for relaying. Damned if someone in malaysia didn't find it and start relaying through us!. We stopped it (the server) reconfigured it, started it back up and all was well, no one can use it as a relay, we get mail through it, send mail through it, all good right? No. It does work as designed, however we still get 4-500 mails an hour from some putz trying to use it. He can't, but for each message, he gets a non delivery. This still floods our system with un-needed traffic. Here's what I see, The person establishes an SMTP copnnection on port 25 They send the message Our server digests it, sees we cannot accept messages for relay send off a notification to the sendor stating that fact. The sender then sends the next message, and on and on for ever and ever. My question. How can I make this stop! Just because some A-Whole had an open port for a couple of hours months ago, now I get his spam mail 24 hours a day. Doug Stelley Network Admin. Olean General Hospital (716)375-7320 Logic is a tweeting bird in a green meadow. - Mr. Spock ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ ISA Server Resource Site: http://www.isaserver.org Windows Security Resource Site: http://www.windowsecurity.com/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: mark@xxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') _______________________ Confidentiality Notice: The information contained in this message may be legally privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any release, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error please notify the author immediately by replying to this message and deleting the original message. Thank you. ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ ISA Server Resource Site: http://www.isaserver.org Windows Security Resource Site: http://www.windowsecurity.com/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: dstelley@xxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') _________________ Confidentiality Notice: The information contained in this message may be legally privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any release, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error please notify the author immediately by replying to this message and deleting the original message. Thank you.