Re: Intractable spam! (Exchange 2000)
- From: "Rich Matheisen [MVP]" <richnews@xxxxxxxxxxxxxxxxxxxxx>
- Date: Sun, 09 Jul 2006 12:56:07 -0400
"Julie" <julie@xxxxxxxxxxxxx> wrote:
We've got this SBS2000 handling email with Exchange. We installed BCWare's NOSPAM utility
and it works very well as a way to deny connections from RBL's. But we've been hammered
over the last few days with this new twist.
The connection comes from a valid host which has a valid PTR and is not on any RBL. The
trouble is that the spam message contents are being sent as SMTP commands, and with a few
of these connections going for hours, server performance slows to a crawl.
Does anyone have a suggestion? Any way to terminate a connection in Exchange 2000 after a
bad SMTP command?
Here's an example: (the 127.0.0.1 is because of the BCWare utility)
Because evrything is from the same IP address you'll have the
impossible task of separating the various messages fro each other. The
information recorded by the SMTP server in the log file lacks any
indication of which data belongs to which message, or event to what
thread of execution in the SMTP server.
What you're seeing is a real PITA. The sending server simply ignores
the 5xx statuses sent by your server and sends its data stream as if
they never occured. That behavior isn't unusual, but thankfully it's
not that common. There's not a lot you can do to thwart it except to
drop the connection. That may be a choice in your anti-spam software.
--
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@xxxxxxxxxxxxx
Or to these, either: mailto:h.pott@xxxxxxxxxxxxxxx mailto:melvin.mcphucknuckle@xxxxxxxxxxxxx mailto:melvin.mcphucknuckle@xxxxxxxxxxxxxxx
.
- Follow-Ups:
- Re: Intractable spam! (Exchange 2000)
- From: Julie
- Re: Intractable spam! (Exchange 2000)
- From: Julie
- Re: Intractable spam! (Exchange 2000)
- References:
- Intractable spam! (Exchange 2000)
- From: Julie
- Intractable spam! (Exchange 2000)
- Prev by Date: Re: Any way to manage Exchange 2003 from an x64 machine
- Next by Date: Re: Intractable spam! (Exchange 2000)
- Previous by thread: Intractable spam! (Exchange 2000)
- Next by thread: Re: Intractable spam! (Exchange 2000)
- Index(es):
Relevant Pages
|
