Re: Spam sent from outside to our internal users, from our internal users addresses!!! E2k

From: Jason L. (jlehrhoff_at_nyc.rr.com)
Date: 02/19/04 

Date: 19 Feb 2004 08:15:10 -0800

You are correct, they are spoofing internal addresses to go to
internal addresses. So, there have been messages that seem to come
from our CEO gonig to other employees here, containing "objectionable"
material. What can be done to ensure that one cannot spoof my domain
as the sender? BTW, I just took my internal subnets out of the smtp
relaying section, and restarted the smtp server, and it still sends
out. Thanks for that so far!!!

-J

"Lanwench [MVP - Exchange]" <lanwench@heybuddy.donotsendme.unsolicitedmail.atyahoo.com> wrote in message news:<#Ikvw#j9DHA.2640@TK2MSFTNGP10.phx.gbl>...
> I don't usually allow anyone or anything to relay through the Exchange
> server - if there's a specific machine on the network that needs it, I'll
> add its IP address. For Exchange to send outbound mail, you don't need to
> allow anything to relay through it.
>
> I don't enable authenticated relay, either - see
> http://www.vamsoft.com/orf/authattack.asp. Have any external POP users use
> their own ISP's SMTP server to send outbound mail.
>
> Again, the issue you're having has nothing to do with relay. Someone is
> spoofing the sender, and sending inbound mail to your domain. Your server is
> by default set up to accept inbound mail from any server - if you start
> modifying that, you likely won't get any inbound mail at all.
>
> Is there something happening that makes you think you're being relayed
> through?

Relevant Pages

  • Re: Relay issue with our Domain
    ... If you connect toi your SMTP server and tell the SMTP server that your ... from a valid accountb in your domain and then you try to send externally, ... servers allowed to relay. ...
    (microsoft.public.exchange2000.admin)
  • Re: Unable to send from localhost
    ... You may also want to add 127.0.0.1 in the "allowed to relay" dialogue box. ... This should allow the MS SMTP server to relay mail from hosts in the "Allows ... Neither of them monitors the loopback address. ...
    (microsoft.public.inetserver.iis.smtp_nntp)
  • Re: queues problem Please help ASAP
    ... >> DNS query for internal DNS ... >>configure relay to be blocked from open relay ... >>The remote server did not respond to a connection attempt. ... > server to use the AD to verify the address on the inbound mail is ...
    (microsoft.public.exchange.admin)
  • Re: How to Stop relaying from inside the company
    ... note that result, if your SMTP Server is blocking the relay, then the result ... How can i stop relaying from inside the company? ...
    (microsoft.public.exchange.admin)
  • Re: Spoof senders return address, Exchange 2003
    ... the mail she sends will likely be tagged as spam by her correspondents because the SRV record of the domain from which she's sending won't match your sending SMTP server. ... When the user sends out an e-mail from within the SBS domain, can she have the return address pointing to her e-mail at her personal domain? ... The network is prone to misuse so the SMTP virtual server has relay permissions unchecked for authenticated users. ...
    (microsoft.public.exchange.admin)
Quantcast