We have an exchange server 2003 and our IP address was blacklisted.
When I check the Queue folder in the exchange server root directory, there are tons of Delivery Status Notification (Delay/Failure) emails to be sent out. The email has from: email@example.com and sent out to different email addresses.
When this happened before, I saw what the IP address (outside our network) in the current sessions that looks like the culprit. So I added it in the blacklist using connection filter in exchange server. This time, when I checked Current Sessions, there were no active connections. But there are still a lot of emails to be sent out from the Queue folder. I have disabled SMTP for now.
I've read in link that if I disable Allow Anonymous Access then I won't be able to receive incoming email from the internet. In the Relay Restrictions dialog, only the localhost computer is in the list. And I have "Allow all computers which successfully authenticate" checked.
How can I find out who is sending out the spam?
Sample email content:
This is an automatically generated Delivery Status Notification. Delivery to the following recipients failed. firstname.lastname@example.org
From: email@example.com To: firstname.lastname@example.org Date: Mon, 27 Jan 2014 22:34:47 -0800 MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="xxxxourdomain.com" X-DSNContext: 7ce717b1 - 1194 - 00000002 - 00000000 Message-ID: <email@example.com> Subject: Delivery Status Notification (Failure)