1

I've been looking into an issue with Exchange where our exchange server seems to be used as a relay for spam.

It is set up to only allow our domain to be able to send out emails which when I've tried to telnet and manually run the SMTP commands seem to work.

However, looking through the logs there is some weird emails that I can see are trying to send spam via us but the MAIL FROM: is just set to <> with a size parameter.

Below is a screenshot:

exchange server log snippet

Does anyone know how someone can send this, and how I can tell exchange to reject it.

Improve this question
2
  • You obfuscated all the important parts!
    – Michael Hampton
    Sep 4, 2014 at 13:17
  • It is set up to only allow our domain to be able to send out emails which when I've tried to telnet and manually run the SMTP commands seem to work. - What does that statement mean exactly?
    – joeqwerty
    Sep 4, 2014 at 16:11

3 Answers 3

Reset to default
1

Thanks everyone for your suggestions. I think I have found the issue. It was related to the external relay on port 25 allowing everything to authenticate, such as Exchange User, Exchage Servers, TLS as well as anonymous.

I believe from my very limited understanding of exchange that when exchange authenticated users are enabled, this automatically defaults to bypass exchanges antispam.

I've turned all this off and only allow anonymous and only allow relaying for recipients with my domain and this has resolved the issue.

Improve this answer
0

There are receive connectors in Exchange that specify which clients are able to connect and what type of authentication is allowed for each. It sounds like you have your entire internal network allowed to relay. You might want to tighten this up a bit and allow only those servers that have a need to send mail externally without going through a MAPI/HTTPS client to relay. In the Exchange MC, go to Server config -> Hub Transport and take a look at your receive connectors. You have a connector for relays that do not use authentication. The list of IPs in the connector should be as small and focused as possible. You should use authentication whereever possible to avoid these issues as well.

Improve this answer
-1

I think that your intranet network was infected with a trojan that sends spam using port 25. You are solely responsible to deny access to external ports 25 465 to all customers internal network and allow only for your mail server

Improve this answer
2
  • Elaborate on why you think his/her network was "infected with a trojan" opposed to any number of other potential exploits.
    – 89c3b1b8-b1ae-11e6-b842-48d705
    Sep 4, 2014 at 12:56
  • 1 Under the trojan I understand any virus that may be part of a botnet 2 virus may be in a network on the server Another 3 variants. This is not a virus. It answers this server to spam newsletter that it takes to not existing addresses
    – Bosh
    Sep 4, 2014 at 13:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .