Hi Torrey,
If you still need help the following methodology might help guide you (speed through to step 2 if you wish)
Step 1
Determine whether you have actually an open relay.
Method 1 - the telnet method – The following is a good Microsoft article which explains the basics (must be done from an offsite machine or network).
http://support.microsoft.com/kb/324958/en-us
This is a useful webcast:
http://support.microsoft.com/?scid=http%3a%2f%2fsupport.microsoft.com%2fservicedesks%2fshowmehow%2f101904_1.asx
Method 2 – (the easy way) download Relay Test Pro from http://www.digiarch.org/relaytest.html
Before you ask I’m not affiliated with the firm in anyway but as a system administrator this tool is an essential. In the time it’ll take you to type your way through 1 test it’ll run 40+ separate tests! – BTW you’ll still need an offsite/network pc to run this from.
Step 2
Ok, you’ve done the tests and you’re an open relay, now you’ve got to block it! The two obvious points to start with are your SMTP Connector and your SMTP Virtual Server. Not too many settings here and in most cases the following should fix it for you: http://support.microsoft.com/kb/324958/en-us
But here’s where it gets interesting; a lot of people report that they have their Exchange Server settings configured correctly but they still have an open relay - how so?
In every case of a properly configured Exchange Server relaying I’ve encountered the root cause lies in the Firewall configuration and how SMTP traffic is passed through to the SMTP server. How to test this - a quick examination of an email message header (right click an email on a client machine and select options) will show that the supposed sending server has a local IP address and of course Exchange Server will treat it as authenticated, see example below:
Microsoft Mail Internet Headers Version 2.0
Received: from msend5.rb.outsideserver.com (.168.1.99] RDNS failed) by someserver.co.uk with Microsoft SMTPSVC(6.0.3790.3959);
Obviously, in this example, the sending SMTP server IP address should be public! Unfortunately there are many flavours of Firewall and for that reason I can’t go in to specifics here but, in general, when an inbound or outbound SMTP connection is NATed to an address other than the one assigned to the physical firewall interface, then the SMTP proxy still uses the physical interface name and address within the SMTP protocol exchange and in doing so rewrites the headers.
If you’ve got exchange configured as it should be and your tests indicate that your server is an open relay then your Firewall is almost certainly to blame.
Step 3
You configured your firewall and Exchange server correctly, ran the test, blocked the open relay, and cleaned up your sever but your still unable to send email to some external domains– why? Well depending on how long your machine has been relaying it's quite possible that your server has been placed on a “Spam Blacklist”. Again another easy one to check – simply go to http://www.dnsstuff.com or http://www.dnsreport.com (no, no affiliation with either but they are sys-admin essentials) put in your IP/Domain name. If you are logged you’ll find your SMTP IP or domain name listed there. Simply contact the list administrator have them delist your server; gradually you’ll mail services will go back to normal.
P.s. only when when you've got the basics right should you start using Intelligent Message Filtering
|