Oh, upon careful re-reading of your first post, you are right. I still think you should flog a user. You'll feel better.
-----Original Message----- From: John Aldrich [mailto:[EMAIL PROTECTED] Sent: Wednesday, June 08, 2005 12:57 PM To: Exchange Discussions Subject: RE: Another question Thanks for the suggestion, Eric... The spam is already going through the mail server... What it sounds like you think I'm saying is that one of our client machines is being used to directly send spam to the internet... but it's not happening that way. Spam is somehow finding it's way into our outbound queue on one Exchange server. I'm not sure how... -----Original Message----- From: Eric Fretz [mailto:[EMAIL PROTECTED] Sent: Wednesday, June 08, 2005 1:28 PM To: Exchange Discussions Subject: RE: Another question Here's how you do this: 1. Locate your site firewall admin. Take him/her out for drinks after work. 2. Over apple martinis, ask him/her to block port 25 outbound for all machines except your site MXs. 3. As for a report of violating IP addresses in a week. 4. Read report, flog user, look like a hero. -----Original Message----- From: John Aldrich [mailto:[EMAIL PROTECTED] Sent: Wednesday, June 08, 2005 12:15 PM To: Exchange Discussions Subject: Another question We have two Exchange 5.5 servers. They are *supposedly* protected by some sort of a pre-filter (we do seem to be blocking emails from sources which don't match up the RDNS.) However, one of the mail servers seems to be routing a LOT of spam. On the other hand, it's not an open relay, as I've run most of the open-relay checks and none of them come up with a "hit." The only thing I can think of, possibly, is that someone has a compromised machine which is being used to relay spam through our Exchange server. If that's the case, I don't know how I'd detect what machine is compromised and fix it... Any suggestions? Thanks John _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
