Re: Exchange Server 5.5 Spam??

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Geoff Pearce (nemx02_at_magma.ca)
Date: 12/03/04 

Date: Fri, 3 Dec 2004 09:52:01 -0500

If <> is the originating email address of the outbound emails then they are
Non Delivery Report

Exchange Server accepts aliases to valid domains at your exchange server.
Later if the alias is undeliverable then Exchange Server returns an Non
Deliver Report (NDR) to the orginator.

Likely at your location spammers are attempting dictionary attacks on your
domains in an attempt to get their emails delivered. A dictionary attack
are emails addressed to a large list of common aliases. Also to prevent the
spammer from being swamped with NDRs the originating email address is
typically spoofed or randomized. Exchange Server attempts to deliver NDRs
to the originator of the emails with invalid aliases during the dictionary
attack. Due to the fact that many of the originating addresses of the spam
are falsified the NDRs sit in the outbound queue (outbound with originating
address of <> or postmaster@yourdomain.com) attempting to go to an invalid
location.

In Exchange 5.5 if you know the invalid recipient emaili address that is
attempted to be delivered to then you can create an DL with no members.
Then assign the problem invalid recipient email address to the DL.

Otherwise you can purchase products which filter invalid recipients (example
ex employees) sent to your exchange server. This prevents items incorrectly
sent to your exchange server from piling up in your Outbound queues.

Nemx Software (which I represent)
http://www.nemx.com/products/powertools/addressmanager.asp

Geoff Pearce
Nemx Software

"knickson" <knickson@discussions.microsoft.com> wrote in message
news:B0D1F91E-CC23-4A85-9A77-E0EB9715A006@microsoft.com...
> I'm trying to determine why my Internet Mail Connector's "Outbound
Messages
> Awaiting Delivery" queue constantly has hundreds of messages awaiting
> delivery, yet the originator is listed as <>?
>
> I've checked the server to ensure it is not being used as a relay and all
> indications tell me that I'm "relay secure".
>
> Any help would be very much appreciated.
>
> We're using Exchange 5.5 SP3.
>
> Thanks in advance.

Relevant Pages

  • Re: Spam Problem
    ... postmaster as the originating email address then you have a dictionary ... Exchange Server accepts aliases to valid domains at your exchange server. ... Messages placed in the bad mail directory can't be ... are falsified the NDRs sit in the outbound queue (outbound with originating ...
    (microsoft.public.exchange2000.general)
  • Re: exchange queue filling up with spam
    ... If or postmaster is the originating email address of the outbound emails ... Exchange Server accepts aliases to valid domains at your exchange server. ... The following article disables Non Delivery Reports in Exchange 2000/2003 ...
    (microsoft.public.exchange.admin)
  • Re: Mails with no sender in the SMTP qeue
    ... If or postmaster is the originating email address of the outbound emails ... Exchange Server accepts aliases to valid domains at your exchange server. ... The following article disables Non Delivery Reports in Exchange 2000/2003 ...
    (microsoft.public.exchange2000.admin)
  • Re: <> tons of them in my queues
    ... postmaster as the originating email address then you have a dictionary ... Exchange Server accepts aliases to valid domains at your exchange server. ... are emails addressed to a large list of common aliases. ... > into the queues fodler on the server I dont see any emails in this folder, ...
    (microsoft.public.exchange.admin)
  • Re: Exchange 5.5 Relay Problem...
    ... If is the originating email address of the outbound emails then they are ... Exchange Server accepts aliases to valid domains at your exchange server. ...
    (microsoft.public.exchange.admin)