1. A Spammer tries to send an e-mail to someone in your org or relay through your server. 2. That person doesn't exist and/or you have your servers set up correctly, so that they can't relay. 3. When that e-mail meets those conditions and is undeliverable, your Exchange server generates and NDR (NON-Delivery report). 4. Because the e-mail address in the headers is faked/forged, your server will try and deliver an NDR to a non-existant domain. 5. When that happens, you get a bunch of these e-mails in your Outbound Delivery Q with an originator of <> and a recipient section of that message saying [Host Unreachable]. 6. They will eventually time out and go away (72 hours I believe) or you can go in and delete them manually.
While it might not be a firewall issue, it very well could be a DNS issue. -----Original Message----- From: Karon Miller [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 15, 2002 9:58 AM To: Exchange Discussions Subject: RE: Anonymous messages in the outbound queue So if an NDR is trying to go to faked addresses used by SPAMMERS, then does that mean that my server is being SPAM RELAYED? I've done the Relay test and it's not being used as a Relay so are they getting in some other way? When I called Microsoft they say it's from a misconfigured firewall but my firewall guy says "impossible". So, I'm back to looking at the Exchange server. Any other ideas? Thanks! It's normal. They're NDRs, and probably NDRs trying to go to the faked addresses used by spammers. Feel free to delete. > > -Peter > > > -----Original Message----- > From: Karon Miller [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, August 13, 2002 9:50 > To: Exchange Discussions > Subject: Anonymous messages in the outbound queue > > > I've tried several things to prevent messages getting stuck in the> > Outbound queue of the IMS it's like someone is relaying SPAM off of > us. I've installed Trend Micro's InterScan 5 Messaging Security Suite > and tried to block anonymous messages that way. Are they NDR's or > messages to user's that are no longer here? Normally I just delete > them everyday but I'm concerned that we're being a relay of somekind. > Is this normal for Exchange 5.5 > > Thanks! > Karon > > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > ______________________________________________ > This message is private or privileged. If you are not the person for > whom this message is intended, please delete it and notify me > immediately, and please do not copy or send this message to anyone > else. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
