Check to see if it is trying to deliver NDRs. I recently had a customer that had an enormous amount of mail in the bad mail plus his SMTP queue was huge. I found that the system was trying to deliver NDRs back to the spammer's address and of course the address was fake.
Philip Walley Sr. Network Engineer Consultrix Technologies Memphis, TN. Consultrix Help Desk: (601) 956-8909 Memphis Office: (901) 383-1300 Memphis Fax: (901) 383-1375 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mellott, Bill Posted At: Wednesday, May 19, 2004 9:53 AM Posted To: Exchange Conversation: [SPAM-?] - Relaying?? - Spam? via [EMAIL PROTECTED] address?? - Email has different SMTP TO: and MIME TO: fields in the email addresses Subject: [SPAM-?] - Relaying?? - Spam? via [EMAIL PROTECTED] address?? - Email has different SMTP TO: and MIME TO: fields in the email addresses Interesting situation... I've got a SBS2003 machine at a location... Running Trenmicro Scanmaiil for AV The other day the thing was hammered.... The Badmail folder had 200K+ files in it There where a bunch of smtp queues for lot's of "messages" in them It appeared that some entity....was "relaying"????? By using the [EMAIL PROTECTED] address Yes the SBS is set NOT to relay..double checked... But it occur's to me that what if some clever spammer did a spoof using the [EMAIL PROTECTED] as the FROM address??? Wouldn't the mail server accept it cause well the domain checks out ok? Any thought's or insites on this? Thanks bill _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
