Re: Mails with no sender in the SMTP qeue

• Previous message: Mark Arnold [MVP]: "Re: Use SMTP relay for our employees"
• In reply to: C.R.: "Re: Mails with no sender in the SMTP qeue"
• Messages sorted by: [ date ] [ thread ]

Date: Sun, 20 Mar 2005 09:48:51 -0500

You could turn of NDRs but that would prevent originators that uninentially
misspell aliases.

Otherwise you need to purchase a third party tool for Exchange 2000 such as

www.vamsoft.com

Geoff Pearce

"C.R." <CR@discussions.microsoft.com> wrote in message
news:EB61C358-6604-4032-8544-5451584B3A57@microsoft.com...
> Geoff.- Thank you for your information, it was very usefull, but is there
> a
> solution to Exchange 2000?
>
> "Geoff Pearce" wrote:
>
>> If <> or postmaster is the originating email address of the outbound
>> emails
>> then they are
>> Non Delivery Report
>>
>> Exchange Server accepts aliases to valid domains at your exchange server.
>> Later if the alias is undeliverable then Exchange Server returns an Non
>> Deliver Report (NDR) to the orginator. If a nondelivery report can't be
>> delivered to the sender, a copy of the original message is placed in the
>> "bad" mail directory. Messages placed in the bad mail directory can't be
>> delivered or returned. You can use the bad mail directory to track
>> potential
>> abuse of your messaging system. By default, the bad mail directory is
>> located at root:\Exchsrvr\Mailroot\vsi#\BadMail, where root is the
>> install
>> drive for Exchange Server and # is the number of the SMTP virtual server,
>> such as C:\Exchsrvr\Mailroot\vsi 1\BadMail. You can change the location
>> of
>> the bad mail directory at any time, but you should never place the
>> directory
>> on the M: drive, which is reserved for other types of Exchange Server
>> data.
>>
>> Likely at your location spammers are attempting dictionary attacks on
>> your
>> domains in an attempt to get their emails delivered. A dictionary attack
>> are emails addressed to a large list of common aliases. Also to prevent
>> the
>> spammer from being swamped with NDRs the originating email address is
>> typically spoofed or randomized. Exchange Server attempts to deliver
>> NDRs
>> to the originator of the emails with invalid aliases during the
>> dictionary
>> attack. Due to the fact that many of the originating addresses of the
>> spam
>> are falsified the NDRs sit in the outbound queue (outbound with
>> originating
>> address of <> or postmaster@yourdomain.com) attempting to go to an
>> invalid
>> location. Eventually the NDRs fail the defined number of retrys and are
>> moved to your Badmail folder.
>>
>> The following article describes how to prevent exchange 2003 server from
>> accepting undeliverable email and therefore would reduce the amount of
>> items
>> in your badmail folder.
>>
>> http://support.microsoft.com/default.aspx?scid=kb;en-us;823866
>>
>> The following article disables Non Delivery Reports in Exchange 2000/2003
>> (NOTE
>> this will not prevent items from being accepted and moved to your Bad
>> Mail
>> folder)
>>
>> http://support.microsoft.com/default.aspx?scid=kb;en-us;294757
>>
>> Geoff Pearce
>>
>> "r_alberto" <ralberto@discussions.microsoft.com> wrote in message
>> news:73976FBB-5118-4D51-9B69-0C63B5372667@microsoft.com...
>> > When I click "Enumerate 100 messages" there appear messages with no
>> > sender
>> > ('sent from' field is blank), is this SMAP? How can I verify who send
>> > the
>> > message? And how can I stop it?
>> > Thank You
>> > --
>> > MCSE WinNT/2k/2k3
>>
>>
>>

• Previous message: Mark Arnold [MVP]: "Re: Use SMTP relay for our employees"
• In reply to: C.R.: "Re: Mails with no sender in the SMTP qeue"
• Messages sorted by: [ date ] [ thread ]