how to disable non-delivery notifications (NDR) in IIS 6

From: Shan McArthur (shan_mcarthur_at_spamcop.net)
Date: 02/17/05

  • Next message: Josh King: "Attachment Icons not displaying" 
    Date: Thu, 17 Feb 2005 15:10:37 -0600

    Hello,

    We are getting quite a large number of "dictionary attacks" related to spam
    and virus email behavior. In other words, they are sending repeated emails
    to a list of common usernames at my domain name. These usernames do not
    exist. Most of this email has a forged and inaccurate sender address. The
    IIS server is sending back an NDR to this forged address. Most of these
    NDRs are not being delivered and are plugging up the queues, taking up a lot
    of disk space, and are consuming a lot of processing power on the server. I
    want to disable the NDRs completely on the IIS SMTP service, but I cannot
    see any way to do that. Is there a registry key or metabase entry that I
    can use to disable the NDRs? Does anyone have an SMTP event sink that can
    trap and disable these NDRs from being delivered?

    The only thing I can see is that there are settings to get these NDRs
    forwarded to an administrative email address and to store them in another
    folder. This would have the effect of creating more mess on the server and
    more emails that should be ignored; both of these are undesirable. I want
    to stop the NDRs completely.

    Thanks,
    Shan McArthur

  • Next message: Josh King: "Attachment Icons not displaying"

    Relevant Pages

    • RE: sendmail blocking
      ... the administrator I don't receive any NDRs. ... >> mail server, and the external world that acts as a mail ... Since Nick has been receiving this junk email for a year now ... marketing mailing lists. ...
      (RedHat)
    • Re: Spam attack
      ... No NDR is generated for an SMTP message denied with a 550 regardless of whether you've configured NDRs or not. ... Once enabled and properly added to the SMTP virtual server, exchange will now generate a 550 for invalid mailboxes instead of accepting and later sending an NDR. ... Somebody can connect and just start throwing addresses at your server and seeing which ones generate 550 or 250, thus eventually gathering legitimate emails. ...
      (microsoft.public.windows.server.sbs)
    • RES: NDRs from spamming
      ... Since you will start sending out lots of NDRs to domains out there, ... your email server use to attach the original message (so message content ... By default, your mail server will issue a NDR for each NDR it receives, ... We are receiving lots of NDRs from hundreds of non-existent ...
      (Incidents)
    • Re: blocking spam ndrs that arent sent by user
      ... Have you or anyone else out there had any success in setting up the Sender ID filtering? ... The NDRs themselves are perfectly genuine, they come from legitimate mail servers, they would all pass SPF tests. ... Invalid email recipients should be detected at the SMTP transaction stage, the sending server informed and the message refused. ... Backup MX hosts that don't perform recipient verification are high on the list as well as Qmail based MTAs which almost always accept mail before firing a backscatter NDR. ...
      (microsoft.public.windows.server.sbs)
    • Re: Question on Recipient Filtering/Possible Harvest Attack
      ... What you don't want, is your server accepting messages for users who don't exist on your domain, and then having to turn around and inform the sending server of that fact. ... Not only does it waste server side resources, but the vast majority of the NDRs will never be able to be delivered because they're addressed to servers that have been 'spoofed' - they don't exist. ... I believe you've already looked up AD filtering and tarpitting, RBL and IMF you should be able to find lots of info with a google groups search of this newsgroup :-). ... be subject to a Directory Harvest Attack. ...
      (microsoft.public.windows.server.sbs)