2

Apparently our domain has been spamlisted, and a check has revealed that we're an open relay.

Internally we have just one mail server, Exchange 2007. No edge transport.

Send connector is configured with Address Space *, cost 1; FQDN same as our MX

Default Receive Connector is same FQDN; authentication is basic only, permission groups are anon, exchange users, exchange servers, legacy exchange.

I don't know how to troubleshoot beyond this.

11
  • How are your accepted domains configured? Oct 7, 2011 at 17:54
  • domain.local is default; domain.com is secondary. both are authoritative
    – derjur
    Oct 7, 2011 at 17:55
  • Are you sure that your Exchange server is the open relay; Exchange 2007+ by default does not allow relaying; so you (or someone) would have had to make it do that. Oct 7, 2011 at 17:57
  • 1
    Try without authenticating whatsoever - and send to an external address. What response line do you get after manually sending a message? Oct 7, 2011 at 18:08
  • 1
    [dave@buzzed:~#] telnet mta.domain.com 25 Trying 66.xx.xx.xx... Connected to mta.domain.com. Escape character is '^]'. e220 mta.domain.com Microsoft ESMTP MAIL Service ready at Fri, 7 Oct 2011 14:17:47 -0400 hlo 250-mta.domain.com Hello [174.xx.xx.xx] mail from: [email protected] 250 2.1.0 Sender OK rcpt to: [email protected] 250 2.1.5 Recipient OK dat 500 5.3.3 Unrecognized command data 354 Start mail input; end with <CRLF>.<CRLF> test . 250 2.6.0 <[email protected]> Queued mail for delivery
    – derjur
    Oct 7, 2011 at 18:23

1 Answer 1

2

In Exchange 2007/2010 you have to manually enable a receive connector to allow permission for open relay.

Run this against your default send connector (the one that accepts from public address space):

Get-ReceiveConnector "Your default Receive Connector" | Get-ADPermission -Identity "NT AUTHORITY\ANONYMOUS LOGON"

If that comes back with ExtendedRights including "ms-Exch-SMTP-Accept-Any-Recipient" then you have an open relay. You need to remove this permission ASAP using Remove-ADPermission

2
  • Seems it's there. Ideas on the Remove-ADPermission string to use?
    – derjur
    Oct 7, 2011 at 22:34
  • 2
    Get-ReceiveConnector “Your default Receive Connector” | Remove-ADPermission -User “NT AUTHORITY\ANONYMOUS LOGON” -ExtendedRights “ms-Exch-SMTP-Accept-Any-Recipient” Oct 8, 2011 at 15:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .