Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am using MailEnable client on my VPS. My server has recently been placed on a black list for spamming.

I have no idea why this is the case. However, after looking through logs it seems that emails are being sent from my server without my knowledge.

Is this possible? How may I stop it?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Yes, it is possible. Your server might be configured as an open relay.

I would start by doing two things. First, I would check the Email Blacklist Check on http://www.mxtoolbox.com/blacklists.aspx. This is one site that will tell you what blacklists your server is on and may give you the reason why your server is on that list.

I would also run an open relay test on your mail server to make sure that it is not configured as an open relay. One open-relay test you can use is at http://www.spamhelp.org/shopenrelay/, and you can Google for others. MailEnable also has a knowledge-base page on open relays at http://www.mailenable.com/kb/Content/Article.asp?ID=me020168

If your server comes back as an open-relay, you can use this knowledge base article to determine what your relay settings should be.

share|improve this answer

My guess would be that your server is configured as an open relay. Have a look at your relay settings (in the Administration program, go to Servers / Localhost / Connectors branch, open the properties for "SMTP" and go to the relay tab) and see how you've got it configured. My default MailEnable requires relaying senders to authenticate. You can allow local senders to relay unauthenticated and to allow IP ranges to relay unauthenticated. The first of those options allows any spammer to forge a "From:" address as one of your users and relay successfully so, generally, it's bad news.

If you're only allowing authenticated relaying then someone may have had their credentials compromised.

SMTP protocol logs, kept in "C:\Program Files\Mail Enable\Logging\SMTP" by default, may help you track down the source of the messages. Consider looking there, too.

If I'm misreading you and you're saying that messages are being sent but aren't hitting the logs then you're probably hosting some malicious software that's sending messages w/o going thru MailEnable. That's always a possibility, too. Look for unexpected processes running and unexpected SMTP traffic that doesn't correspond to logged traffic from MailEnable.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.