Re: how to disable non-delivery notifications (NDR) in IIS 6

From: Peter D. Hipson (mcn01)
Date: 02/17/05 

Date: Thu, 17 Feb 2005 17:14:17 -0500

You should look into the idea of using a catchall account. That
account would get all emails that there is no mailbox for. Then you
could setup a timed delete to simply delete them.

I do this on my email servers, and it reduces substantially the
outbound traffic consisting of NDA messages, which since the SPAM has
forged headers ends up going to some other poor victim!

Additionally you can setup routines to look at the mail in the
catchall account and pick up ones that are legit but mis-addressed. I
use an email client to do all of this (the delete, and the picking up
of valid, misaddressed email. Even outlook can do it.

On Thu, 17 Feb 2005 15:10:37 -0600, "Shan McArthur"
<shan_mcarthur@spamcop.net> wrote:

>Hello,
>
>We are getting quite a large number of "dictionary attacks" related to spam
>and virus email behavior. In other words, they are sending repeated emails
>to a list of common usernames at my domain name. These usernames do not
>exist. Most of this email has a forged and inaccurate sender address. The
>IIS server is sending back an NDR to this forged address. Most of these
>NDRs are not being delivered and are plugging up the queues, taking up a lot
>of disk space, and are consuming a lot of processing power on the server. I
>want to disable the NDRs completely on the IIS SMTP service, but I cannot
>see any way to do that. Is there a registry key or metabase entry that I
>can use to disable the NDRs? Does anyone have an SMTP event sink that can
>trap and disable these NDRs from being delivered?
>
>The only thing I can see is that there are settings to get these NDRs
>forwarded to an administrative email address and to store them in another
>folder. This would have the effect of creating more mess on the server and
>more emails that should be ignored; both of these are undesirable. I want
>to stop the NDRs completely.
>
>Thanks,
>Shan McArthur
>

PeterD, the Darkstar Network
To email, fix my address!
ExpertZone!

Relevant Pages

  • RE: sendmail blocking
    ... the administrator I don't receive any NDRs. ... >> mail server, and the external world that acts as a mail ... Since Nick has been receiving this junk email for a year now ... marketing mailing lists. ...
    (RedHat)
  • Re: Spam attack
    ... No NDR is generated for an SMTP message denied with a 550 regardless of whether you've configured NDRs or not. ... Once enabled and properly added to the SMTP virtual server, exchange will now generate a 550 for invalid mailboxes instead of accepting and later sending an NDR. ... Somebody can connect and just start throwing addresses at your server and seeing which ones generate 550 or 250, thus eventually gathering legitimate emails. ...
    (microsoft.public.windows.server.sbs)
  • RES: NDRs from spamming
    ... Since you will start sending out lots of NDRs to domains out there, ... your email server use to attach the original message (so message content ... By default, your mail server will issue a NDR for each NDR it receives, ... We are receiving lots of NDRs from hundreds of non-existent ...
    (Incidents)
  • Re: blocking spam ndrs that arent sent by user
    ... Have you or anyone else out there had any success in setting up the Sender ID filtering? ... The NDRs themselves are perfectly genuine, they come from legitimate mail servers, they would all pass SPF tests. ... Invalid email recipients should be detected at the SMTP transaction stage, the sending server informed and the message refused. ... Backup MX hosts that don't perform recipient verification are high on the list as well as Qmail based MTAs which almost always accept mail before firing a backscatter NDR. ...
    (microsoft.public.windows.server.sbs)
  • Re: Question on Recipient Filtering/Possible Harvest Attack
    ... What you don't want, is your server accepting messages for users who don't exist on your domain, and then having to turn around and inform the sending server of that fact. ... Not only does it waste server side resources, but the vast majority of the NDRs will never be able to be delivered because they're addressed to servers that have been 'spoofed' - they don't exist. ... I believe you've already looked up AD filtering and tarpitting, RBL and IMF you should be able to find lots of info with a google groups search of this newsgroup :-). ... be subject to a Directory Harvest Attack. ...
    (microsoft.public.windows.server.sbs)
Loading