RE: Spam related problems

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: maprime12 (maprime12_at_discussions.microsoft.com)
Date: 08/18/04 

Date: Wed, 18 Aug 2004 09:27:02 -0700

Tom,

Try running you mail server through multiple spam relay testers. Some good
ones are at http://spamlinks.openrbl.org/tools-relay.htm#web. This should
give you an idea of how messages are getting through. The next step is to
make it so that your POP/IMAP users who send mail legitimately through your
system are authenticated first. This can be done by going into the smtp
virtual server/access and selecting authentication. Make sure that anonymous
is checked off for inbound mail to your domain. Also, make sure that Basic
and windows integrated authentication is checked off also.

After this is done, go to relay, the default radio button selected should be
"only the list below" You can leave it blank if you'd like, or input any
domains/ip addresses that can relay. Make sure that the check box on the
bottom is checked off. It says "Allow all computers which successfully
authenticate to relay, regardless of the list above. On the POP/IMAP
clients, there should be a checkbox for outgoing mail authentication, select
it and they should be able to use the same settings as inbound mail
selection. If after doing this, you still have people saying that they're
getting spammed from you, turn up diagnostic logging on your smtp protocol.
That's in the properties of your server. Set it to maximum for
msExchangeTransport. Whenever a message is relayed through your server, it
will note the ip address/domain name. Compare this with the message headers
of the messages that your isp says are coming from your system. Since
authentication is needed, the spammer must have a valid username/password for
your system. Sorry for the lengthy reply, hope that this helps.

Regards,

Marvin Pritchett
Senior Sys Admin.
RMA of NY

"Tom" wrote:

> Hi, Any help appreciated on this one.
>
> I am having problems with my exchange 2000 server, the
> only way to explain it is that spam email messages are
> being sent through it! My ISP has sent me logs that prove
> this (it's not just a relay problem, that is locked down
> fine) and somebody submitted an anti spam report that
> tracked back to my server. The other interesting thing is
> that these spam messages have my disclaimer notice
> attached to the bottom (which is automatically appended to
> outgoing SMTP messages).
>
> Would anyone be aware of any hacks that might enable
> someone to do this? I am all out of ideas and the threat
> of being blacklisted is looming over me.
>
>
>
>

Quantcast