Re: External messages "spoofed" as coming from our internal domain are accepted

From: Deji Akomolafe (deji_at_)
Date: 03/04/04 

Date: Wed, 3 Mar 2004 22:25:54 -0800

Nothing you can do about this. It's not a misconfiguration, so nothing to
correct. You'd only be worried IF the destination mailbox does not exist
WITHIN your organization. E2K will accept ANY FROM address. Actually ANY
SMTP server should accept mail from any from address as long as the TO is
within your org. 

-- 
Sincerely,
Dèjì Akómöláfé, MCSE MCSA MCP+I
www.akomolafe.com
www.iyaburo.com
Do you now realize that Today is the Tomorrow you were worried about
Yesterday?  -anon
"D. Kelly" <support@samsonmanagement.com> wrote in message
news:3b2501c40167$20f4cd30$a601280a@phx.gbl...
> Full Subject: External messages "spoofed" as coming from
> our internal domain are accepted and delivered to valid
> internal users.
>
> Any suggestions to correct this issue would be appreciated:
>
> Users are receiving external internet e-mail
> which appears to be sent from non-existent users
> "successfully pretending" to be within our
> internally defined system.
>
>     eg.   Lets say I have a valid MX record
> for "mydomain.com" &
>           gus@mydomain.com receives a message from
> bob@mydomain.com
>           Unfortunately...
>           Although gus@mydomain.com is a valid user which
> we administer,
>           bob@mydomain.com doesn't exist.
>           Nevertheless someone can externally
> spoof "bob@mydomain.com"
>           & my Exchange 2000 system delivers the mail
>           as if bob@mydomain.com is a valid account
>
> Extra System Details -
>
>  Our corporate e-mail's MX record points mail
> for "mydomain.com" to the
>  external IP of an ISA firewall.
>  There's publishing rule(s) on the ISA server to forward
> SMTP traffic
>  for "mydomain.com" to our Exchange Server.
>                      &
>  The Exchange Server's SMTP connector -
>  - accepts the ISA server's "forwarded" messages
>  - & ultimately handles message delivery
>
> Although I've examined the ISA publishing rules &
> Exchange's SMTP connector settings;
> I'm uncertain where the "security"/mail delivery failure
> occurs.
> Ideally, I would prefer to have Exchange Server properly
> manage/handle the SMTP mail
> rather than make ISA server do the job for Exchange.
>
> Thanks in advance.
>
> D. Kelly
> POSTING TO:
>  microsoft.public.exchange2000.transport &
>  microsoft.public.exchange2000.general

Relevant Pages

  • Exchange 5.5 (move from MS Proxy to ISA 2004) REPOST
    ... I'm simply trying to publish Exchange 5.5 on ISA 2004. ... SMTP and SMTPS Server rules from external/internal to the exchange server ...
    (microsoft.public.isa.configuration)
  • Re: Intermittent inbound delivery to Exchange
    ... > This also sounds like it could be a problem with what addresses SMTP ... >> to forward mail to the internal Exchange 2003 server on Windows ... the queue fills on the ISA Server. ... >> use an internal DNS on the DC, ...
    (microsoft.public.exchange.admin)
  • Re: ISA 2004 SMTP Filtering
    ... But I was under the impression that the SMTP filter allowed ... Trying to make the loads on each server smaller, ... being able to deliver mail to the ISA would ... your IMail to control everything else related to relaying, spam, ect. ...
    (microsoft.public.isa)
  • Re: Intermittent inbound delivery to Exchange
    ... If ISA ... My thought is the SMTP filer is corrupt. ... > forward mail to the internal Exchange 2003 server on Windows 2003. ... > All servers use an internal DNS on the DC, ...
    (microsoft.public.exchange.admin)
  • RE: Relaying
    ... Disabled SMTP filter and things seem to be working. ... Is this the correct configuration with ISA and Exchange ... information is not sent to the Exchange server. ...
    (microsoft.public.isa)