Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Apparently our domain has been spamlisted, and a check has revealed that we're an open relay.

Internally we have just one mail server, Exchange 2007. No edge transport.

Send connector is configured with Address Space *, cost 1; FQDN same as our MX

Default Receive Connector is same FQDN; authentication is basic only, permission groups are anon, exchange users, exchange servers, legacy exchange.

I don't know how to troubleshoot beyond this.

share|improve this question
    
How are your accepted domains configured? –  Shane Madden Oct 7 '11 at 17:54
    
domain.local is default; domain.com is secondary. both are authoritative –  derjur Oct 7 '11 at 17:55
    
Are you sure that your Exchange server is the open relay; Exchange 2007+ by default does not allow relaying; so you (or someone) would have had to make it do that. –  Coding Gorilla Oct 7 '11 at 17:57
1  
Try without authenticating whatsoever - and send to an external address. What response line do you get after manually sending a message? –  Shane Madden Oct 7 '11 at 18:08
1  
[dave@buzzed:~#] telnet mta.domain.com 25 Trying 66.xx.xx.xx... Connected to mta.domain.com. Escape character is '^]'. e220 mta.domain.com Microsoft ESMTP MAIL Service ready at Fri, 7 Oct 2011 14:17:47 -0400 hlo 250-mta.domain.com Hello [174.xx.xx.xx] mail from: derjur@gmail.com 250 2.1.0 Sender OK rcpt to: derjur@gmail.com 250 2.1.5 Recipient OK dat 500 5.3.3 Unrecognized command data 354 Start mail input; end with <CRLF>.<CRLF> test . 250 2.6.0 <473d162b-c5ba-48ec-b8fb-1949d04bbee2@bmexch1.domain.local> Queued mail for delivery –  derjur Oct 7 '11 at 18:23
show 6 more comments

1 Answer

In Exchange 2007/2010 you have to manually enable a receive connector to allow permission for open relay.

Run this against your default send connector (the one that accepts from public address space):

Get-ReceiveConnector "Your default Receive Connector" | Get-ADPermission -Identity "NT AUTHORITY\ANONYMOUS LOGON"

If that comes back with ExtendedRights including "ms-Exch-SMTP-Accept-Any-Recipient" then you have an open relay. You need to remove this permission ASAP using Remove-ADPermission

share|improve this answer
    
Seems it's there. Ideas on the Remove-ADPermission string to use? –  derjur Oct 7 '11 at 22:34
2  
Get-ReceiveConnector “Your default Receive Connector” | Remove-ADPermission -User “NT AUTHORITY\ANONYMOUS LOGON” -ExtendedRights “ms-Exch-SMTP-Accept-Any-Recipient” –  George Hewitt Oct 8 '11 at 15:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.