Hello,

My SBS 2003 server is sending out lots of junk email. Its definately
not relaying but its happening when the pop connector collects email,
it looks at all the email addresses in the headers and then sends all
the non local emails to the SMTP connector to re-deliver!

I've put a bogus smarthost in my SMTP connector for now so I can see
all the msgs queing up to be sent. Presumably I've missed something
fairly obvious on the setup ... can anyone advise?

Rgrds,
Jon

Re: Mail server sending out unwanted email - not relaying by CRIS

CRIS
Mon Sep 13 13:13:03 CDT 2004

This is a multi-part message in MIME format.

------=_NextPart_000_035A_01C49993.66F08EE0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

are you sure that what you're seeing going back out is not NDRs??

--=20
Cris Hanna (SBS-MVP)
_____________________
Please only respond in the Newsgroup and not directly to me, so that =
everyone can share the information
"Project Sega" <usenet@TAKE-THIS-OUTjon.lamb.co.uk> wrote in message =
news:c2obk01shivap3taftele7uc4u0gv9f871@4ax.com...
Hello,

My SBS 2003 server is sending out lots of junk email. Its definately
not relaying but its happening when the pop connector collects email,
it looks at all the email addresses in the headers and then sends all
the non local emails to the SMTP connector to re-deliver!=20

I've put a bogus smarthost in my SMTP connector for now so I can see
all the msgs queing up to be sent. Presumably I've missed something
fairly obvious on the setup ... can anyone advise?

Rgrds,
Jon
------=_NextPart_000_035A_01C49993.66F08EE0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1400" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>are you sure that what you're seeing =
going back out=20
is not NDRs??</FONT></DIV>
<DIV><BR>-- <BR>Cris Hanna (SBS-MVP)<BR>_____________________<BR>Please =
only=20
respond in the Newsgroup and not directly to me, so that everyone can =
share the=20
information</DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Project Sega" &lt;<A=20
=
href=3D"mailto:usenet@TAKE-THIS-OUTjon.lamb.co.uk">usenet@TAKE-THIS-OUTjo=
n.lamb.co.uk</A>&gt;=20
wrote in message <A=20
=
href=3D"news:c2obk01shivap3taftele7uc4u0gv9f871@4ax.com">news:c2obk01shiv=
ap3taftele7uc4u0gv9f871@4ax.com</A>...</DIV>Hello,<BR><BR>My=20
SBS 2003 server is sending out lots of junk email. Its =
definately<BR>not=20
relaying but its happening when the pop connector collects =
email,<BR>it looks=20
at all the email addresses in the headers and then sends all<BR>the =
non local=20
emails to the SMTP connector to re-deliver! <BR><BR>I've put a bogus =
smarthost=20
in my SMTP connector for now so I can see<BR>all the msgs queing up to =
be=20
sent. Presumably I've missed something<BR>fairly obvious on the setup =
... can=20
anyone advise?<BR><BR>Rgrds,<BR>Jon</BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_035A_01C49993.66F08EE0--


Re: Mail server sending out unwanted email - not relaying by Project

Project
Mon Sep 13 13:49:26 CDT 2004

On Mon, 13 Sep 2004 13:13:03 -0500, "CRIS HANNA \(SBS-MVP\)"
<crishannanospam@computingpossibilities.net> wrote:

>are you sure that what you're seeing going back out is not NDRs??

Good point, I'm not sure. Is there a way of stopping the NDRs?

Rgrds,
Jon

Re: Mail server sending out unwanted email - not relaying by CRIS

CRIS
Mon Sep 13 13:55:24 CDT 2004

This is a multi-part message in MIME format.

------=_NextPart_000_03C5_01C49999.515111D0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Not at a server at the moment but if you look in Exchange Admin help =
under NDRs you will get some options.

--=20
Cris Hanna (SBS-MVP)
_____________________
Please only respond in the Newsgroup and not directly to me, so that =
everyone can share the information
"Project Sega" <usenet@TAKE-THIS-OUTjon.lamb.co.uk> wrote in message =
news:fsqbk0pvr58hlet5o8upb6uk35g2r26i12@4ax.com...
On Mon, 13 Sep 2004 13:13:03 -0500, "CRIS HANNA \(SBS-MVP\)"
<crishannanospam@computingpossibilities.net> wrote:

>are you sure that what you're seeing going back out is not NDRs??

Good point, I'm not sure. Is there a way of stopping the NDRs?

Rgrds,
Jon
------=_NextPart_000_03C5_01C49999.515111D0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1400" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>Not at a server at the moment but if =
you look in=20
Exchange Admin help under NDRs you will get some options.</FONT></DIV>
<DIV><BR>-- <BR>Cris Hanna (SBS-MVP)<BR>_____________________<BR>Please =
only=20
respond in the Newsgroup and not directly to me, so that everyone can =
share the=20
information</DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Project Sega" &lt;<A=20
=
href=3D"mailto:usenet@TAKE-THIS-OUTjon.lamb.co.uk">usenet@TAKE-THIS-OUTjo=
n.lamb.co.uk</A>&gt;=20
wrote in message <A=20
=
href=3D"news:fsqbk0pvr58hlet5o8upb6uk35g2r26i12@4ax.com">news:fsqbk0pvr58=
hlet5o8upb6uk35g2r26i12@4ax.com</A>...</DIV>On=20
Mon, 13 Sep 2004 13:13:03 -0500, "CRIS HANNA \(SBS-MVP\)"<BR>&lt;<A=20
=
href=3D"mailto:crishannanospam@computingpossibilities.net">crishannanospa=
m@computingpossibilities.net</A>&gt;=20
wrote:<BR><BR>&gt;are you sure that what you're seeing going back out =
is not=20
NDRs??<BR><BR>Good point, I'm not sure. Is there a way of stopping the =

NDRs?<BR><BR>Rgrds,<BR>Jon</BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_03C5_01C49999.515111D0--


Re: Mail server sending out unwanted email - not relaying by Javier

Javier
Mon Sep 13 14:32:56 CDT 2004

You can disable NDRs (completely) by going to Exchange System Manager->
Global Settings-> Internet Message Format-> Advanced tab-> Uncheck "allow
non-delivery reports".

However, personally I do not like to do this... since sometimes there are
valid reasons to send NDRs. I like to filter inbound messages to only those
in the directory (so the server doesn't have to send NDRs because of
"address unknown"). You can do this by going to Exchange System Manager ->
Global Settings -> Message Delivery-> Properties-> Recipient Filtering tab->
Enable "Filter recipients who are not in the Directory".

--
Javier [SBS MVP]

<< SBS ROCKS!!! >>

"CRIS HANNA (SBS-MVP)" <crishannanospam@computingpossibilities.net> wrote in
message news:ut2T0LcmEHA.512@TK2MSFTNGP10.phx.gbl...
Not at a server at the moment but if you look in Exchange Admin help under
NDRs you will get some options.

--
Cris Hanna (SBS-MVP)
_____________________
Please only respond in the Newsgroup and not directly to me, so that
everyone can share the information
"Project Sega" <usenet@TAKE-THIS-OUTjon.lamb.co.uk> wrote in message
news:fsqbk0pvr58hlet5o8upb6uk35g2r26i12@4ax.com...
On Mon, 13 Sep 2004 13:13:03 -0500, "CRIS HANNA \(SBS-MVP\)"
<crishannanospam@computingpossibilities.net> wrote:

>are you sure that what you're seeing going back out is not NDRs??

Good point, I'm not sure. Is there a way of stopping the NDRs?

Rgrds,
Jon



Re: Mail server sending out unwanted email - not relaying by Project

Project
Mon Sep 13 14:45:07 CDT 2004

On Mon, 13 Sep 2004 15:32:56 -0400, "Javier Gomez [SBS MVP]"
<javier_gomez@REMOVE.THIS.engineer.com> wrote:

>You can disable NDRs (completely) by going to Exchange System Manager->
>Global Settings-> Internet Message Format-> Advanced tab-> Uncheck "allow
>non-delivery reports".
>
>However, personally I do not like to do this... since sometimes there are
>valid reasons to send NDRs. I like to filter inbound messages to only those
>in the directory (so the server doesn't have to send NDRs because of
>"address unknown"). You can do this by going to Exchange System Manager ->
>Global Settings -> Message Delivery-> Properties-> Recipient Filtering tab->
>Enable "Filter recipients who are not in the Directory".

Hiya,

Thanks for that. I've just VPN'd into the server and checked the queue
and the out outgoing queue has senders from my postmaster which I
guess are the NDR's but it also has senders that i dont recognise
which is what I suspect are the re-deliveries. I've set the settings
that you mention above. Can I ask, what would now happen to msgs that
are received that are not in the directory? Are they dropped or
bounced?

Rgrds,
Jon

Re: Mail server sending out unwanted email - not relaying by CRIS

CRIS
Mon Sep 13 14:56:36 CDT 2004

This is a multi-part message in MIME format.

------=_NextPart_000_0494_01C499A1.DDABBA60
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

understand that many of those attempts are never gonna get back to the =
original send cause the address was a fake to begin with for spamming.
And postmaster is the address used for NDRs

If you check your server you'll find a folder called BADMAIL...thats =
where they all are

--=20
Cris Hanna (SBS-MVP)
_____________________
Please only respond in the Newsgroup and not directly to me, so that =
everyone can share the information
"Project Sega" <usenet@TAKE-THIS-OUTjon.lamb.co.uk> wrote in message =
news:ontbk0dggqb0rj8kss2kng2p9ic3nj8g76@4ax.com...
On Mon, 13 Sep 2004 15:32:56 -0400, "Javier Gomez [SBS MVP]"
<javier_gomez@REMOVE.THIS.engineer.com> wrote:

>You can disable NDRs (completely) by going to Exchange System =
Manager->=20
>Global Settings-> Internet Message Format-> Advanced tab-> Uncheck =
"allow=20
>non-delivery reports".
>
>However, personally I do not like to do this... since sometimes there =
are=20
>valid reasons to send NDRs. I like to filter inbound messages to only =
those=20
>in the directory (so the server doesn't have to send NDRs because of=20
>"address unknown"). You can do this by going to Exchange System =
Manager ->=20
>Global Settings -> Message Delivery-> Properties-> Recipient =
Filtering tab->=20
>Enable "Filter recipients who are not in the Directory".

Hiya,

Thanks for that. I've just VPN'd into the server and checked the queue
and the out outgoing queue has senders from my postmaster which I
guess are the NDR's but it also has senders that i dont recognise
which is what I suspect are the re-deliveries. I've set the settings
that you mention above. Can I ask, what would now happen to msgs that
are received that are not in the directory? Are they dropped or
bounced?

Rgrds,
Jon
------=_NextPart_000_0494_01C499A1.DDABBA60
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1400" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>understand that many of those attempts =
are never=20
gonna get back to the original send cause the address was a fake to =
begin with=20
for spamming.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>And postmaster is the address used for=20
NDRs</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>If you check your server you'll find a =
folder=20
called BADMAIL...thats where they all are</FONT></DIV>
<DIV><BR>-- <BR>Cris Hanna (SBS-MVP)<BR>_____________________<BR>Please =
only=20
respond in the Newsgroup and not directly to me, so that everyone can =
share the=20
information</DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Project Sega" &lt;<A=20
=
href=3D"mailto:usenet@TAKE-THIS-OUTjon.lamb.co.uk">usenet@TAKE-THIS-OUTjo=
n.lamb.co.uk</A>&gt;=20
wrote in message <A=20
=
href=3D"news:ontbk0dggqb0rj8kss2kng2p9ic3nj8g76@4ax.com">news:ontbk0dggqb=
0rj8kss2kng2p9ic3nj8g76@4ax.com</A>...</DIV>On=20
Mon, 13 Sep 2004 15:32:56 -0400, "Javier Gomez [SBS MVP]"<BR>&lt;<A=20
=
href=3D"mailto:javier_gomez@REMOVE.THIS.engineer.com">javier_gomez@REMOVE=
.THIS.engineer.com</A>&gt;=20
wrote:<BR><BR>&gt;You can disable NDRs (completely) by going to =
Exchange=20
System Manager-&gt; <BR>&gt;Global Settings-&gt; Internet Message =
Format-&gt;=20
Advanced tab-&gt; Uncheck "allow <BR>&gt;non-delivery=20
reports".<BR>&gt;<BR>&gt;However, personally I do not like to do =
this... since=20
sometimes there are <BR>&gt;valid reasons to send NDRs. I like to =
filter=20
inbound messages to only those <BR>&gt;in the directory (so the server =
doesn't=20
have to send NDRs because of <BR>&gt;"address unknown"). You can do =
this by=20
going to Exchange System Manager -&gt; <BR>&gt;Global Settings -&gt; =
Message=20
Delivery-&gt; Properties-&gt; Recipient Filtering tab-&gt; =
<BR>&gt;Enable=20
"Filter recipients who are not in the =
Directory".<BR><BR>Hiya,<BR><BR>Thanks=20
for that. I've just VPN'd into the server and checked the queue<BR>and =
the out=20
outgoing queue has senders from my postmaster which I<BR>guess are the =
NDR's=20
but it also has senders that i dont recognise<BR>which is what I =
suspect are=20
the re-deliveries. I've set the settings<BR>that you mention above. =
Can I ask,=20
what would now happen to msgs that<BR>are received that are not in the =

directory? Are they dropped=20
or<BR>bounced?<BR><BR>Rgrds,<BR>Jon</BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_0494_01C499A1.DDABBA60--


Re: Mail server sending out unwanted email - not relaying by Javier

Javier
Mon Sep 13 15:22:02 CDT 2004

> Can I ask, what would now happen to msgs that
> are received that are not in the directory? Are they dropped or
> bounced?

The message gets rejected. The sender's mailserver gets "5.1.1 user unknown"
error message. Now the its the sender's mailserver responsability to send
the NDR, not yours... so somebody should recieve an NDR when they make a
typo on the address (something that wouldn't happen if you disable all
NDRs).

I must say there is caveat here... with this setup a "spammer" potentially
can harvest valid email addresses. But, I must say this is not likely (IMO)
+ the benefits outweight the potential issues.

--
Javier [SBS MVP]

<< SBS ROCKS!!! >>

"Project Sega" <usenet@TAKE-THIS-OUTjon.lamb.co.uk> wrote in message
news:ontbk0dggqb0rj8kss2kng2p9ic3nj8g76@4ax.com...
> On Mon, 13 Sep 2004 15:32:56 -0400, "Javier Gomez [SBS MVP]"
> <javier_gomez@REMOVE.THIS.engineer.com> wrote:
>
>>You can disable NDRs (completely) by going to Exchange System Manager->
>>Global Settings-> Internet Message Format-> Advanced tab-> Uncheck "allow
>>non-delivery reports".
>>
>>However, personally I do not like to do this... since sometimes there are
>>valid reasons to send NDRs. I like to filter inbound messages to only
>>those
>>in the directory (so the server doesn't have to send NDRs because of
>>"address unknown"). You can do this by going to Exchange System Manager ->
>>Global Settings -> Message Delivery-> Properties-> Recipient Filtering
>>tab->
>>Enable "Filter recipients who are not in the Directory".
>
> Hiya,
>
> Thanks for that. I've just VPN'd into the server and checked the queue
> and the out outgoing queue has senders from my postmaster which I
> guess are the NDR's but it also has senders that i dont recognise
> which is what I suspect are the re-deliveries. I've set the settings
> that you mention above. Can I ask, what would now happen to msgs that
> are received that are not in the directory? Are they dropped or
> bounced?
>
> Rgrds,
> Jon



Re: Mail server sending out unwanted email - not relaying by Project

Project
Mon Sep 13 16:37:26 CDT 2004

On Mon, 13 Sep 2004 16:22:02 -0400, "Javier Gomez [SBS MVP]"
<javier_gomez@REMOVE.THIS.engineer.com> wrote:

>> Can I ask, what would now happen to msgs that
>> are received that are not in the directory? Are they dropped or
>> bounced?
>
>The message gets rejected. The sender's mailserver gets "5.1.1 user unknown"
>error message. Now the its the sender's mailserver responsability to send
>the NDR, not yours... so somebody should recieve an NDR when they make a
>typo on the address (something that wouldn't happen if you disable all
>NDRs).
>
>I must say there is caveat here... with this setup a "spammer" potentially
>can harvest valid email addresses. But, I must say this is not likely (IMO)
>+ the benefits outweight the potential issues.

Thanks for your help Javier,

I'll check the server over the next day or so but I think your right
and this is the best solution.

Rgrds,
Jon


Re: Mail server sending out unwanted email - not relaying by Project

Project
Mon Sep 13 16:41:48 CDT 2004

On Mon, 13 Sep 2004 14:56:36 -0500, "CRIS HANNA \(SBS-MVP\)"
<crishannanospam@computingpossibilities.net> wrote:

>understand that many of those attempts are never gonna get back to the original send cause the address was a fake to begin with for spamming.
>And postmaster is the address used for NDRs
>
>If you check your server you'll find a folder called BADMAIL...thats where they all are

Hiya,

Thanks for that. Now I've had a closer look at the queue, I can see
that most of them are NDR's. Some of them do seem to be re-deliveries
though which depending on the type of msg will occasionally turn into
a mail loop :-/

Hopefully, now I'm filtering based on the address exisiting in the
directory will cure that.

Rgrds,
Jon