Re: IIS 5's SMTP and Stopping NDR's ?

Hi Sandy - I might have spoken too soon :-0

I noticed after installing 5xxxsink no mail was flowing either in or our of
the server. Careful checking showed these errors in the event log;

Event ID 7031
The IIS Admin Service service terminated unexpectedly. It has done this 13
time(s). The following corrective action will be taken in 1 milliseconds:
Run the configured recovery program.

Event ID 7031
The Simple Mail Transport Protocol (SMTP) service terminated unexpectedly.
It has done this 13 time(s). The following corrective action will be taken
in 0 milliseconds: No action.

Event ID 7031
The World Wide Web Publishing Service service terminated unexpectedly. It
has done this 12 time(s). The following corrective action will be taken in 0
milliseconds: No action.

Event ID 2
IIS stop command received from user NT AUTHORITY\SYSTEM. The logged data is
the status code.
For additional information specific to this message please visit the
Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.

Event ID 1
IIS start command received from user NT AUTHORITY\SYSTEM. The logged data is
the status code.
For additional information specific to this message please visit the
Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.

and then they start over again. Un-installing 5xxsink re-enabled mail to
flow again and stopped the error logs from filling up with these messages.

Any ideas on why that would happen? I'm running Windows 2000 AS with all
updates installed.



"Dave Onex" <dave@xxxxxxxx> wrote in message
news:uYUm529nHHA.4424@xxxxxxxxxxxxxxxxxxxxxxx

"Sanford Whiteman" <swhitemanlistens-software@xxxxxxxxxxxxxxxxxxxxx> wrote
in message news:op.tsx98ybz6c17zw@xxxxxxxxxxxxxxxxxxxxxxx
I didn't know that could be done. Can you elaborate on how this is
accomplished using Exchange 2000 and
a separate SMTP machine as a relay? If I can get the mail server to
just
reject all connection attempts to non-existant mailboxes that would be
a
lot
better :-)

5xxSink is a transport event sink specifically designed for the
rejection
of
unknown recipients at the MX.

Download:



http://www.imprimia.com/products/software/freeutils/5xxsink/download/release

Be sure to go over the README and RELNOTES in-depth.

Thanks for the link - it's exactly what I'm after and as you've pointed
out
(and educated me in the process) it's the preferred solution :-)

Funny thing - when I copy and paste the following I got an error (due to
syntax)

cscript smtpreg.vbs /add 1 oninboundcommand 5xxsink
5xxsink.sink "rcpt"

but when I manually entered the command it worked :-)


I don't know much about that - all I know is that my IIS 5 SMTP
machine
is
kindly sending NDR reports for every email it receives that is not
addressed
to an existing mailbox. Of course, the account used to send the mail
does
not exist so it's a waste for everyone.

Quite so. For you, the waste is abetted by accepting the mail in the
first place. *Just* because something was sent to a nonexistent
mailbox doesn't mean it was spam -- as such user errors occur, in
small but non-negligible quantity, all the time.

Agreed - although you know more about this then I do :-)


Your server is absolutely correct to generate an NDR by default, in
the absence of any spam detection at that level. When the sender is
legit, the NDR is invaluable.

Agreed - it would be a shame to cut that functionality due to spam


When the sender is forged or does not exist, the NDR is extremely
problematic, one the first hand making you complicit in Joe Jobs, and
on the second resulting in postmaster messages (double-bounce
notifications).

But not anymore..... :-)
Thank you very much Sandy - I appreciate the education and also the better
way to resolve the issue. Much appreciated!


--Sandy




.

Relevant Pages

  • Re: EXCHANGE SERVER Unexepectedly turn off & back on again UNEXPECTEDLYD
    ... Also report whatever you see in your system event log. ... your server plugged into a UPS with a management cable? ... > corrective action will be taken in 1 milliseconds: ...
    (microsoft.public.outlook)
  • Re: Possible Error in Patch 331953?
    ... using SQL Server 2000 and the db server doesn't seem to be affected at ... > corrective action will be taken in 0 milliseconds: ... > all had the exact same event log entries at the same time, ... > all servers which had this patch were) ...
    (microsoft.public.win2000.security)
  • Re: *asp failure after installing Hotfix MS02-010/Q331953
    ... Possible Error in Patch 331953? ... complaint was that our Oracle database server CPU ... corrective action will be taken in 0 milliseconds: ... all had the exact same event log entries at the same time, ...
    (microsoft.public.win2000.security)
  • Re: NDR Details
    ... MTA...that will put detailed messages in your event log. ... >> First thing is to get a copy of the NDR, that will give an indication as ... >>> become aware that our server is bouncing 'desirable' messages. ... Are there logs I ...
    (microsoft.public.exchange.admin)
  • 5.3.0 NDR for only 1 domain.
    ... Good Day we get the following NDR when we try and send mail to a particular ... the server. ... And the following event in the event log: ... Check your route and topology; use the winroute tool to ensure the ...
    (microsoft.public.exchange.connectivity)