Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running a Windows 2003 server with MailEnable 2.0 (I know it's old, but it's a production server and difficult to upgrade).

The server only allows relaying from local IP addresses, but this is without authentication so that scripts (websites) located on the server can send email. It does not allow authentication-based relay because this is not a general mail server and there's no need for that.

Someone has recently begun sending spam from the server, through a script which I cannot identify. I would like to force every sender to at least use a local 'from' address, but checking this option in MailEnable (under SMTP properties > Relay) basically means that people can send email "from" local addresses OR from the local IP, not AND like I would hope.

Please suggest how I can go about either tracking down or blocking the spammer without hurting the ability of other websites to send email. Thanks in advance.

share|improve this question
    
Enable SMTP logging on the server and check those logs if it uses the IIS SMTP service. If not, look at the MailEnable logs. Surely there's a log somewhere that you can use to identify the ip addresss of the host that's sending the spam email through this server. –  joeqwerty Nov 8 '12 at 14:37
    
Neither the SMTP log nor the debug log in MailEnable give any clue, because the IP is the server IP. As I said, a script on the server is sending the spam, but there are thousands of mail scripts on the server, I can't go about checking each one. Is there anything I'm missing? –  Ynhockey Nov 10 '12 at 19:41
    
I misunderstood. I though there were other servers on the LAN that were sending through this server. –  joeqwerty Nov 10 '12 at 19:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.