Outgoing mail filtering

15 Dec 2008 2:14 PM

Mark

I have an Exchange 2003 Server. Is there a way to block mail being sent TO
a specific domain and/or a specific e-mail address?

We are under some kind if SPAM attack which is causing mail to pile up on
the message queue. When I look at the specifics of the messages in the
outgoing queue, all are coming FROM one of the following addresses,
serv***@usbank.com, serv***@IRS.GOV, or serv***@capitalone.com. Until I can
get this resolved I want to block all mail going TO those 3 addresses.

Thanks.

15 Dec 2008 4:57 PM

Lanwench [MVP - Exchange]

Mark <ma***@csbonline.net> wrote:

> I have an Exchange 2003 Server. Is there a way to block mail being
> sent TO a specific domain and/or a specific e-mail address?
>
> We are under some kind if SPAM attack which is causing mail to pile
> up on the message queue. When I look at the specifics of the messages
> in the outgoing queue, all are coming FROM one of the following
> addresses, serv***@usbank.com, serv***@IRS.GOV, or
> serv***@capitalone.com. Until I can get this resolved I want to
> block all mail going TO those 3 addresses.
> Thanks.

If it's *from* those addresses, it isn't *to* them. Who is it to?

You can set up recipient filtering but these are senders, yes? You can't
block by sender domain, although you can block mail from certain SMTP
addresses. I don't know that it will help you in this case, as those
messages are likely not really from the senders you see listed there.

Are you on SP2? Do you have filtering enabled? Do you have authenticated
relay (on by default) still enabled? I would turn that off.

http://technet.microsoft.com/en-us/library/aa995992(EXCHG.65).aspx
http://www.msexchange.org/tutorials/microsoft-exchange-intelligent-message-filter.html
http://www.msexchange.org/tutorials/Exchange-Spam.html

15 Dec 2008 5:31 PM

Mark

"Lanwench [MVP - Exchange]"
<lanwe***@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
Show quoteHide quote

news:u4rbtftXJHA.5388@TK2MSFTNGP05.phx.gbl...
> Mark <ma***@csbonline.net> wrote:
>> I have an Exchange 2003 Server. Is there a way to block mail being
>> sent TO a specific domain and/or a specific e-mail address?
>>
>> We are under some kind if SPAM attack which is causing mail to pile
>> up on the message queue. When I look at the specifics of the messages
>> in the outgoing queue, all are coming FROM one of the following
>> addresses, serv***@usbank.com, serv***@IRS.GOV, or
>> serv***@capitalone.com. Until I can get this resolved I want to
>> block all mail going TO those 3 addresses.
>> Thanks.
>
> If it's *from* those addresses, it isn't *to* them. Who is it to?

The messages are "to" random addresses. It's almost like someone is using
our server to relay mail. I have checked and double-checked and ran a bunch
of tests and the server is NOT an open relay.

> You can set up recipient filtering but these are senders, yes? You can't
> block by sender domain, although you can block mail from certain SMTP
> addresses. I don't know that it will help you in this case, as those
> messages are likely not really from the senders you see listed there.
>
> Are you on SP2? Do you have filtering enabled? Do you have authenticated
> relay (on by default) still enabled? I would turn that off.

Yes, SP2 is installed. Can you be a bit more specific here? Where is
this "authenticated relay" you are refferring to? Also, what type of
filtering are you asking about? Sender, Recepient, IP?

Show quoteHide quote

> http://technet.microsoft.com/en-us/library/aa995992(EXCHG.65).aspx
> http://www.msexchange.org/tutorials/microsoft-exchange-intelligent-message-filter.html
> http://www.msexchange.org/tutorials/Exchange-Spam.html
>

15 Dec 2008 6:53 PM

Lanwench [MVP - Exchange]

Mark <ma***@csbonline.net> wrote:
Show quoteHide quote

> "Lanwench [MVP - Exchange]"
> <lanwe***@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
> message news:u4rbtftXJHA.5388@TK2MSFTNGP05.phx.gbl...
>> Mark <ma***@csbonline.net> wrote:
>>> I have an Exchange 2003 Server. Is there a way to block mail being
>>> sent TO a specific domain and/or a specific e-mail address?
>>>
>>> We are under some kind if SPAM attack which is causing mail to pile
>>> up on the message queue. When I look at the specifics of the
>>> messages in the outgoing queue, all are coming FROM one of the
>>> following addresses, serv***@usbank.com, serv***@IRS.GOV, or
>>> serv***@capitalone.com. Until I can get this resolved I want to
>>> block all mail going TO those 3 addresses.
>>> Thanks.
>>
>> If it's *from* those addresses, it isn't *to* them. Who is it to?
>
> The messages are "to" random addresses. It's almost like someone is
> using our server to relay mail. I have checked and double-checked and
> ran a bunch of tests and the server is NOT an open relay.
>
>> You can set up recipient filtering but these are senders, yes? You
>> can't block by sender domain, although you can block mail from
>> certain SMTP addresses. I don't know that it will help you in this
>> case, as those messages are likely not really from the senders you
>> see listed there. Are you on SP2? Do you have filtering enabled? Do you
>> have
>> authenticated relay (on by default) still enabled? I would turn that
>> off.
>
> Yes, SP2 is installed. Can you be a bit more specific here? Where
> is this "authenticated relay" you are refferring to?

In the properties of your virtual SMTP server. However, note that this may
not be the source of your issue. You may just be getting spam.

> Also, what type
> of filtering are you asking about? Sender, Recepient, IP?

Sender & recipient & connection will help the most.
Show quoteHide quote

>
>> http://technet.microsoft.com/en-us/library/aa995992(EXCHG.65).aspx
>> http://www.msexchange.org/tutorials/microsoft-exchange-intelligent-message-filter.html
>> http://www.msexchange.org/tutorials/Exchange-Spam.html