RE: Unresolved recipients don't get filtered ?

Tech-Archive recommends: Fix windows errors by optimizing your registry

Hi Daniel,

Thanks for your detail description.

From your information, the issue should be caused by IMF configuration. I
would like to suggest you refer to the following article to configure IMF.

Intelligent Message Filter on SBS 2003:
http://www.smallbizserver.net/Default.aspx?tabid=129

And also the following articles may be useful to you.

Approach to Fighting Spam in an Exchange Environment
http://www.microsoft.com/technet/community/events/exchange2003/tnt1-132.mspx

http://www.microsoft.com/downloads/details.aspx?FamilyId=B1218D8C-E8B3-48FB-
9208-6F75707870C2&displaylang=en

If the IMF still don't work, please help me collect the system and
application log for further analyze.

To save a text copy of Application /System log:

A. Open Event Viewer: Start -> All Programs -> Administrative Tools ->
Event Viewer.
B. Right-click on Application/System log and select "Save Log File As?".

Please mail the log files to my working mailbox: v-yanniw@xxxxxxxxxxxxx

Have a nice day!

Sincerely,

Jenny Wu
Microsoft CSS Online Newsgroup Support
======================================================

PLEASE NOTE the newsgroup SECURE CODE and PASSWORD will be updated at 9:00
AM PST, February 14, 2006. Please complete a re-registration process by
entering the secure code mmpng2006 when prompted. Once you have entered the
secure code mmpng2006, you will be able to update your profile and access
the partner newsgroups.

======================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from this issue.

======================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

======================================================

--------------------
Thread-Topic: Unresolved recipients don't get filtered ?
thread-index: AcYs6dwURYk3xilRQmeF4IeGzhAgEw==
X-WBNR-Posting-Host: 208.181.54.253
From: =?Utf-8?B?RGFuaWVs?= <Daniel@xxxxxxxxxxxxxxxxxxxxxxxxx>
References: <844E75C7-91E1-4B3E-AF58-85F3E44ABF10@xxxxxxxxxxxxx>
<wxV18w8KGHA.1240@xxxxxxxxxxxxxxxxxxxxx>
Subject: RE: Unresolved recipients don't get filtered ?
Date: Wed, 8 Feb 2006 11:57:15 -0800
Lines: 161
Message-ID: <BEC34B11-DC13-44B8-8763-69CC34BCADD0@xxxxxxxxxxxxx>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.windows.server.sbs
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:243078
X-Tomcat-NG: microsoft.public.windows.server.sbs

Good Day Jenny,

Thank you for help.

There two MX records: first one pointing to the SBS static IP, second to
beanfield.com which is also authoritative for the mycompany.com SMTP
domain.
The second mail server beanfield.com which I belive is using VPOPmail, is
responsible for generating NDR, being at the end of the chain.
http://support.microsoft.com/kb/321721/
Some employees don't have an account on the SBS server, however they have
an
email address @mycompany.com residing on beanfield com.
When an email comes in to SBS if the address is not found in Active
Directories, Exchange will forward that email to Beanfield.com as
uresolved
recipient, so external users can retrieve their emails.
There's a bit more work with this setup as 3 sets of accounts have to be
maintained ( SBS, POP3 connector, and WebMail on Beanfield ), but if
there's
a problem with the SBS or Internet, the users can use webmail to access
their
emails, then when SBS is back on line it will pull all the emails with the
pop3 connector.// ++ saving in licenses for the external users...
The growing problem is with invalid addresses, due to spoofed domain, that
go to the second server, or trying as sometimes get stuck in the Exchange
Queue.
What are your thaughts working with this setup, and what would be a better
way of dealing with spam?

Your help is much appreciated.
Daniel

""Jenny wu [MSFT]"" wrote:

Hi Daniel,

Thanks for using the SBS newsgroup.

To answer your second question:

SenderID (http://www.microsoft.com/senderid) is the e-mail
authentication
framework that targets one of the most common security issues in the
world
of SMTP message transfer, which is spoofing. In short Sender ID allows
administrators of an e-mail domain to protect the identity of this
e-mail
domain by registering the special DNS record, also called SPF record,
that
lists the hosts (IP addresses, names, etc) that are authorized to send
e-mail from that domain. For example the SPF record for @microsoft.com
e-mail domain lists about 20 authorized hosts. You can pre-view the
record
by doing "nslookup -q=TXT Microsoft.com" and then "nslookup -q=TXT
_spf.microsoft.com".

So Exchange 2003 SP2 allows to query Internet DNS for SenderID/SPF
records
for the given domain mentioned as the sender domain in an e-mail message
and then, depending on the result of that check, take appropriate
actions
on that message,. The action could range from blocking the message at
the
protocol level (for example when SenderID check returns the "Failed"
status) or passing the message to the next layer of filtering such as
Intelligent Message Filter which takes the SenderID check result into
account when making its anti-spam analysis decisions.

So the Send ID does not filter unresolved recipient emails. If we select
the Reject option in the Sender ID Filtering, the recipient will not
receive the specific message that failed the Sender ID verification and
the
NDR notification will be sent to the sender directly.

For more detailed information about how to configure the Sender ID
Filtering, please refer to the following articles:

Sender ID Home Page
http://www.microsoft.com/mscorp/safety/technologies/senderid/default.mspx

Sender ID Framework SPF Record Wizard
http://www.anti-spamtools.org/SenderIDEmailPolicyTool/Default.aspx

Sender ID
http://blogs.technet.com/exchange/archive/2005/10/13/412487.aspx

Before we go further to your first question, please kindly help me
collect
some information to isolate the issue.

1. What is your network topology? Please describe more detail about your
network structure for analyze the issue.

2. What is the meaning of the sentence "We need that as some remote
users
don't have a domain account but they need an email address
@mycompany.com.
"? How you implement the function that one user account has not domain
account but has domain email address?

3. What is the "the second server"? Is it exchange server or other
servers?
Where it locates in network? What is the relationship between the second
server and exchange server or SBS server box?

I appreciate your time! I am happy to be of assistance to you and look
forward to your reply.

Have a nice day!

Sincerely,

Jenny Wu
Microsoft CSS Online Newsgroup Support
======================================================

PLEASE NOTE the newsgroup SECURE CODE and PASSWORD will be updated at
9:00
AM PST, February 14, 2006. Please complete a re-registration process by
entering the secure code mmpng2006 when prompted. Once you have entered
the
secure code mmpng2006, you will be able to update your profile and
access
the partner newsgroups.

======================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from this issue.

======================================================

This posting is provided "AS IS" with no warranties, and confers no
rights.

======================================================

--------------------
Thread-Topic: Unresolved recipients don't get filtered ?
thread-index: AcYrgk1jaq3phYKvRKaS0EXV2hnuPA==
X-WBNR-Posting-Host: 24.83.96.244
From: =?Utf-8?B?RGFuaWVs?= <Daniel@xxxxxxxxxxxxxxxxxxxxxxxxx>
Subject: Unresolved recipients don't get filtered ?
Date: Mon, 6 Feb 2006 17:03:27 -0800
Lines: 16
Message-ID: <844E75C7-91E1-4B3E-AF58-85F3E44ABF10@xxxxxxxxxxxxx>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.windows.server.sbs
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGXA03.phx.gbl
Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:242627
X-Tomcat-NG: microsoft.public.windows.server.sbs

Hello Everybody,

There are 3 filter mechanisms against spam: Message Screener provided
by
ISA2k4, IMF by Exchange and TrendMicro CSM ver3, however the last 2
filters
don't seem to filter emails sent to a second mail server as unresolved
recipients. We need that as some remote users don't have a domain
account
but
they need an email address @mycompany.com. The main problem is that the
second server rejects some emails and the queue can get very large on
Exchange Server, which has to be cleaned up regularly.
Have I missed a setting or is it normal that IMF and Trend don't filter
emails redirected to another mail server?
The other question I have is Sender ID going to filter these unresolved
recipient emails?

Your input is much appreciated.
Daniel





.

Relevant Pages

  • RE: Unresolved recipients dont get filtered ?
    ... first one pointing to the SBS static IP, ... so external users can retrieve their emails. ... In short Sender ID allows ... So the Send ID does not filter unresolved recipient emails. ...
    (microsoft.public.windows.server.sbs)
  • Re: Somewhat OFF TOPIC--------regarding spam to the group
    ... If you see a message from a sender you want to block, click the "Message" menu, select the "Create filter from message". ... It is interesting that occasionally someone will spam us, or try to incite a flame war, and if it isn't pretty much ignored, it sometimes starts an interesting discussion within the group here. ... Pati, in Phx ...
    (rec.crafts.textiles.quilting)
  • Re: 4 Relais Fernschalten mit NF: IC oder Schaltungsvorschlag gesucht.
    ... sollte dann die NF-Frequenzen sorgfältig auswählen, ... einen langen Impuls werden beide Zähler im Sender ... Kurze Impulse zählen ... den Filter kann man auch ganz konventionell mit einem ausgeschlachteten Ringkern und einem Kondensator bauen. ...
    (de.sci.electronics)
  • email filter for repeat offenders
    ... to assist with writing an email filter. ... more obnoxious email kickbacks to the sender. ... Incoming email not already on the black-list will be sent there based ...
    (comp.lang.perl.misc)
  • Re: OT--message rules question
    ... to the folder, so the crap that's there remains there. ... It is literlly hundreds of posts regarding sex ... I tried blocking the sender. ... I haven't found a way to filter on message bodies with X- ...
    (alt.sys.pc-clone.dell)