Help Needed - Relay Issue?

Microsoft News Groups · Joined: 21 Nov 2007 Posts: 1

Hello All:

Seems there is unauthorized mail being sent from my server and I cannot
figure out how. I've tested the server from several different open relay
sites and it comes up good. I've scanned from viruses with the latest defs
and it also came up good. From the log files, I can see that mail is being
relayed and I cannot figure out how. Below is a few lines from the smtp
logs. Any help would be appreciated. Thanks in advance.

2007-11-20 05:00:33 69.42.57.92 mxserv30.com.57.42.69.in-addr.arpa SMTPSVC1
0 250
2007-11-20 05:00:33 69.42.57.92 mxserv30.com.57.42.69.in-addr.arpa SMTPSVC1
0 240
2007-11-20 05:00:39 194.2.0.80 OutboundConnectionResponse SMTPSVC1 25 0
2007-11-20 05:00:39 194.2.0.80 OutboundConnectionCommand SMTPSVC1 25 0
2007-11-20 05:00:39 194.2.0.80 OutboundConnectionResponse SMTPSVC1 25 0
2007-11-20 05:02:07 76.4.105.92 fl-76-4-105-92.dhcp.embarqhsd.net SMTPSVC1 0
250
2007-11-20 05:02:07 76.4.105.92 fl-76-4-105-92.dhcp.embarqhsd.net SMTPSVC1 0
250
2007-11-20 05:02:07 76.4.105.92 fl-76-4-105-92.dhcp.embarqhsd.net SMTPSVC1 0
250
2007-11-20 05:02:07 76.4.105.92 fl-76-4-105-92.dhcp.embarqhsd.net SMTPSVC1 0
250
2007-11-20 05:02:07 76.4.105.92 fl-76-4-105-92.dhcp.embarqhsd.net SMTPSVC1 0
240
2007-11-20 05:02:43 64.71.41.19 OutboundConnectionResponse SMTPSVC1 25 0

Archived from group: microsoft>public>exchange2000>admin

Lanwench [MVP - Exchange] · Joined: 05 Aug 2007 Posts: 875

Microsoft News Groups wrote:
> Hello All:
>
> Seems there is unauthorized mail being sent from my server and I
> cannot figure out how. I've tested the server from several different
> open relay sites and it comes up good. I've scanned from viruses with
> the latest defs and it also came up good. From the log files, I can
> see that mail is being relayed and I cannot figure out how. Below is
> a few lines from the smtp logs. Any help would be appreciated. Thanks
> in advance.

The logs you've included don't indicate you're being used as a relay
(although they aren't detailed enough to demonstrate either way). Let's
start with the basics - what precisely makes you believe you're being used
as one?

See http://www.msexchange.org/tutorials/MF005.html for a good overview of
relaying and spam. E2k/2003 do not permit open relay by default, although
they do permit authenticated relay.

If you don't have strong/complex password policies enabled, force regular
password changes, have enabled guest, etc., someone may exploit
authenticated relay. If you don't need authenticated relay, disable it. You
can always have any external POP users use their own ISP's SMTP server for
outbound mail anyway.
See http://www.vamsoft.com/orf/authattack.asp

Exchnage 2000 Open Relay Issue!! "Help" I followed this tech article and then I used abuse.net to test the server for relaying and it still is relaying. I connected home and was able to telnet and relay too. The server is W

Exchange 2007 relay problem I have installed a exchange 2007 server in a mixed environment 2000/2007. I can't send mail out of my organization (for explample to gmail.com) I get a 'Unable to relay' error. If I add the domain * to accepted domains I can send out but I become an open

"send as" permission replication issue When I give a user the "send as" permission on an other user's mailbox, this setting will replicate itself away after sometime. If I set this permission on one server I can sometimes see it on an other server as well, but after a while (10-15 min), this s

IMF clarification needed When setting up IMF there's an option to "Archive" as opposed to Reject, Delete, and No Action. My question is, where is the "archive" stored and how can I access it periodically to ensure that there are no legitimate email there. Thanks,

OMA Problem Help Needed!! Dear all, After applying the DU4 the OMA breaks, even with applying SP1 does not help. Does anyone know how to fix this? Error as shown below. Thanks. Server Error in '/OMA' Application.