If you're relay secure (and there's no way for me to tell because I do not know your e-mail domain), these are likely NDRs to messages sent as spam or by a virus with an address on your system that is forged as the reply-to or from address of the message. There isn't much you can do aside from implementing the catch-all event script, and that may have more impact on legitimate mail that you might like.
Ed Crowley MCSE+Internet MVP Freelance E-Mail Philosopher Protecting the world from PSTs and Bricked Backups!T -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jerry J. Sent: Friday, April 09, 2004 1:12 PM To: Exchange Discussions Subject: Getting this notification, any thoughts appreciated Notification: Outbound Mail Failure - A protocol error occurred. Getting a ton of these in the last couple of days. In the body of the message neither the to or from are local addresses to the server. And the reasons are 501 mail not accepted from blacklisted IP address 550 ILLEGAL [EMAIL PROTECTED] 553 Blocked for spam 554 1081539553.3687.hitel accept denied. [code=3] 560 Blocked for filter, so the connection will be closed 553 5.3.0 Server not ready.46 554 Message Rejected Due To Virus Found In Attachment 550 Error: Maybe_Spam!!_Rejected!_0001 550 5.0.0 We don't accept Advertisement Mail!!! etc etc.. Now I know that my server is not an open relay. I have tested it using various online tests as well as having a few friends try to relay with no success. Can I assume that this is someone who forged the from with my domain? Or is someone actually relaying thru me? _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
