Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Apparently our domain has been spamlisted, and a check has revealed that we're an open relay.

Internally we have just one mail server, Exchange 2007. No edge transport.

Send connector is configured with Address Space *, cost 1; FQDN same as our MX

Default Receive Connector is same FQDN; authentication is basic only, permission groups are anon, exchange users, exchange servers, legacy exchange.

I don't know how to troubleshoot beyond this.

share|improve this question
How are your accepted domains configured? – Shane Madden Oct 7 '11 at 17:54
domain.local is default; is secondary. both are authoritative – derjur Oct 7 '11 at 17:55
Are you sure that your Exchange server is the open relay; Exchange 2007+ by default does not allow relaying; so you (or someone) would have had to make it do that. – Coding Gorilla Oct 7 '11 at 17:57
Try without authenticating whatsoever - and send to an external address. What response line do you get after manually sending a message? – Shane Madden Oct 7 '11 at 18:08
[dave@buzzed:~#] telnet 25 Trying 66.xx.xx.xx... Connected to Escape character is '^]'. e220 Microsoft ESMTP MAIL Service ready at Fri, 7 Oct 2011 14:17:47 -0400 hlo Hello [174.xx.xx.xx] mail from: 250 2.1.0 Sender OK rcpt to: 250 2.1.5 Recipient OK dat 500 5.3.3 Unrecognized command data 354 Start mail input; end with <CRLF>.<CRLF> test . 250 2.6.0 <473d162b-c5ba-48ec-b8fb-1949d04bbee2@bmexch1.domain.local> Queued mail for delivery – derjur Oct 7 '11 at 18:23

In Exchange 2007/2010 you have to manually enable a receive connector to allow permission for open relay.

Run this against your default send connector (the one that accepts from public address space):

Get-ReceiveConnector "Your default Receive Connector" | Get-ADPermission -Identity "NT AUTHORITY\ANONYMOUS LOGON"

If that comes back with ExtendedRights including "ms-Exch-SMTP-Accept-Any-Recipient" then you have an open relay. You need to remove this permission ASAP using Remove-ADPermission

share|improve this answer
Seems it's there. Ideas on the Remove-ADPermission string to use? – derjur Oct 7 '11 at 22:34
Get-ReceiveConnector “Your default Receive Connector” | Remove-ADPermission -User “NT AUTHORITY\ANONYMOUS LOGON” -ExtendedRights “ms-Exch-SMTP-Accept-Any-Recipient” – George Hewitt Oct 8 '11 at 15:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.