Exchange server 2003

[Sandman]

Firewall was the first thing that sprung to mine... or SMTP issue.....

[PiqueABoo]

This is an SMTP protocol warning log for virtual server ID 2, connection #499808. The remote host "65.55.37.120", responded to the SMTP command "mail" with "421 RP-001 (COL0-MC4-F48) Unfortunately, some messages from 195.188.250.172 weren't sent. Please try again. We have limits for how many messages can be sent per hour and per day. You can also refer to Troubleshooting. ". The full command sent was "MAIL FROM:<oscarjeffry@yahoo.in> SIZE=3227 ". This may cause the connection to fail.

Hmm.. that's apparently a hotmail server saying it can't accept a mail from a @yahoo.in address because your server is sending too many e-mails. Why is your server involved in mail between yahoo and hotmail addresses?

First thing to check (soon) is whether you have some kind open-relay (or spam-bot) problem. Google will get you lots of articles about checking/fixing that - offhand I don't know which might be a really good article for Exchange 2003, but someone else might.

[sukh]

What fo the SMTP logs say?

[Ryno]

Sorry im not being very helpful i aint a clue on exchange never worked with it before in my life. How can i view smtp logs? i looked threw the queue and there was something like 22,000 emails trying to be sent.

[Ryno]

Im Trying to re run the internet mail wizard but get an error saying To send Internet e-mail, the selected server cannot be a bridgehead server.

[timzim]

This might help: How to block open SMTP relaying and clean up Exchange Server SMTP queues

[sukh]

Log location is in that KB I postred earlier

[Ryno]

When trying to open logs they are just saying file to large to open.

[Ryno]

Is there anyway i can reinstall exchange without losing all the emails and things like that?

[Ryno]

i just ran the internet mail wizard and heres the log this created.

29/03/2012 11:39
Server 'EXCHANGE' has been selected as the Internet Gateway Server

Inbound Configuration was selected:
Your current settings for the SMTP Virtual Server 'Default SMTP Virtual Server' are:
-Relay Restrictions = closed relay
-Access Control / Authentication = Anonymous Access is enabled
Your settings for the SMTP virtual server 'Default SMTP Virtual Server' will now be:
-Relay Restrictions = closed relay
-Access Control / Authentication = Anonymous Access is enabled
-The domain(s) your server is configured to accept inbound mail for are the following authoritative inbound SMTP domains that are configured in Recipient Policies: ololprimary.co.uk;olol.local;mail.ololprimary.co.u k;

Outbound Configuration was selected:
-New SMTP connector named 'Internet Mail SMTP Connector (EXCHANGE)' will be created under routing group 'First Routing Group'
-SMTP Virtual Server 'Default SMTP Virtual Server' is configured as the Outbound Bridgehead with the following settings:
-Uses DNS to send email
-Allows delivery to all Internet e-mail domains

Results:
Successfully created the SMTP connector 'Internet Mail SMTP Connector (EXCHANGE)'
Successfully modified the SMTP Virtual Server 'Default SMTP Virtual Server'

[sukh]

any chance of you PM me the SMTP logs?
If they are huge either zip or cut n past a section

[Ryno]

oting.aspx#errors. 0 0 255 0 390 SMTP - - - -
2012-03-29 11:53:02 65.55.92.152 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+SNT0-MC2-F23.Snt0.hotmail.com+Sending+unsolicited+commercia l+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited .+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/a...4:47:23+-0700+ 0 0 242 0 125 SMTP - - - -
2012-03-29 11:53:02 65.55.92.152 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 125 SMTP - - - -
2012-03-29 11:53:02 65.55.92.152 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-SNT0-MC2-F23.Snt0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 266 SMTP - - - -
2012-03-29 11:53:02 65.55.92.152 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:<Ryan.Fagan@ololprimary.co.uk>+SIZE=1232 0 0 4 0 266 SMTP - - - -
2012-03-29 11:53:02 65.55.92.152 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(SNT0-MC2-F23)+Unfortunately,+some+messages+from+195.188.250 .172+weren't+sent.+Please+try+again.+We+have+limit s+for+how+many+messages+can+be+sent+per+hour+and+p er+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 407 SMTP - - - -
2012-03-29 11:53:03 65.55.92.168 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+SNT0-MC3-F11.Snt0.hotmail.com+Sending+unsolicited+commercia l+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited .+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/a...4:47:24+-0700+ 0 0 242 0 125 SMTP - - - -
2012-03-29 11:53:03 65.55.92.168 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 125 SMTP - - - -
2012-03-29 11:53:03 65.55.92.168 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-SNT0-MC3-F11.Snt0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 250 SMTP - - - -
2012-03-29 11:53:03 65.55.92.168 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:<Ryan.Fagan@ololprimary.co.uk>+SIZE=1232 0 0 4 0 250 SMTP - - - -
2012-03-29 11:53:03 65.55.92.168 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(SNT0-MC3-F11)+Unfortunately,+some+messages+from+195.188.250 .172+weren't+sent.+Please+try+again.+We+have+limit s+for+how+many+messages+can+be+sent+per+hour+and+p er+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 375 SMTP - - - -
2012-03-29 11:53:03 65.54.188.94 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC2-F15.Bay0.hotmail.com+Sending+unsolicited+commercia l+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited .+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/a...4:47:24+-0700+ 0 0 242 0 171 SMTP - - - -
2012-03-29 11:53:03 65.54.188.94 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 171 SMTP - - - -
2012-03-29 11:53:03 65.54.188.94 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC2-F15.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 328 SMTP - - - -
2012-03-29 11:53:03 65.54.188.94 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:<Ryan.Fagan@ololprimary.co.uk>+SIZE=1232 0 0 4 0 328 SMTP - - - -
2012-03-29 11:53:03 65.54.188.94 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(BAY0-MC2-F15)+Unfortunately,+some+messages+from+195.188.250 .172+weren't+sent.+Please+try+again.+We+have+limit s+for+how+many+messages+can+be+sent+per+hour+and+p er+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 500 SMTP - - - -
2012-03-29 11:53:04 65.54.188.110 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC3-F31.Bay0.hotmail.com+Sending+unsolicited+commercia l+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited .+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/a...4:47:25+-0700+ 0 0 242 0 156 SMTP - - - -
2012-03-29 11:53:04 65.54.188.110 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 156 SMTP - - - -
2012-03-29 11:53:04 65.54.188.110 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC3-F31.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 312 SMTP - - - -
2012-03-29 11:53:04 65.54.188.110 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:<Ryan.Fagan@ololprimary.co.uk>+SIZE=1232 0 0 4 0 312 SMTP - - - -
2012-03-29 11:53:04 65.54.188.110 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(BAY0-MC3-F31)+Unfortunately,+some+messages+from+195.188.250 .172+weren't+sent.+Please+try+again.+We+have+limit s+for+how+many+messages+can+be+sent+per+hour+and+p er+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 469 SMTP - - - -
2012-03-29 11:53:04 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC4-F37.Bay0.hotmail.com+Sending+unsolicited+commercia l+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited .+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/a...4:47:25+-0700+ 0 0 242 0 172 SMTP - - - -
2012-03-29 11:53:04 65.54.188.126 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 172 SMTP - - - -
2012-03-29 11:53:04 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC4-F37.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 328 SMTP - - - -
2012-03-29 11:53:04 65.54.188.126 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:<Ryan.Fagan@ololprimary.co.uk>+SIZE=1232 0 0 4 0 328 SMTP - - - -
2012-03-29 11:53:04 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(BAY0-MC4-F37)+Unfortunately,+some+messages+from+195.188.250 .172+weren't+sent.+Please+try+again.+We+have+limit s+for+how+many+messages+can+be+sent+per+hour+and+p er+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 484 SMTP - - - -
2012-03-29 11:53:06 65.54.188.72 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC1-F32.Bay0.hotmail.com+Sending+unsolicited+commercia l+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited .+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/a...4:47:26+-0700+ 0 0 242 0 156 SMTP - - - -
2012-03-29 11:53:06 65.54.188.72 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 156 SMTP - - - -
2012-03-29 11:53:06 65.54.188.72 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC1-F32.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 328 SMTP - - - -
2012-03-29 11:53:06 65.54.188.72 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:<Ryan.Fagan@ololprimary.co.uk>+SIZE=1232 0 0 4 0 328 SMTP - - - -
2012-03-29 11:53:06 65.54.188.72 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(BAY0-MC1-F32)+Unfortunately,+some+messages+from+195.188.250 .172+weren't+sent.+Please+try+again.+We+have+limit s+for+how+many+messages+can+be+sent+per+hour+and+p er+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 484 SMTP - - - -
2012-03-29 11:53:06 65.55.37.104 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+COL0-MC3-F34.Col0.hotmail.com+Sending+unsolicited+commercia l+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited .+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/a...4:47:27+-0700+ 0 0 242 0 156 SMTP - - - -
2012-03-29 11:53:06 65.55.37.104 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 156 SMTP - - - -
2012-03-29 11:53:06 65.55.37.104 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-COL0-MC3-F34.Col0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 312 SMTP - - - -
2012-03-29 11:53:06 65.55.37.104 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:<Ryan.Fagan@ololprimary.co.uk>+SIZE=1232 0 0 4 0 312 SMTP - - - -
2012-03-29 11:53:06 65.55.37.104 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(COL0-MC3-F34)+Unfortunately,+some+messages+from+195.188.250 .172+weren't+sent.+Please+try+again.+We+have+limit s+for+how+many+messages+can+be+sent+per+hour+and+p er+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 468 SMTP - - - -
2012-03-29 11:53:07 65.55.37.88 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+COL0-MC2-F37.Col0.hotmail.com+Sending+unsolicited+commercia l+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited .+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/a...4:47:27+-0700+ 0 0 242 0 157 SMTP - - - -
2012-03-29 11:53:07 65.55.37.88 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 157 SMTP - - - -
2012-03-29 11:53:07 65.55.37.88 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-COL0-MC2-F37.Col0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 313 SMTP - - - -
2012-03-29 11:53:07 65.55.37.88 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:<Ryan.Fagan@ololprimary.co.uk>+SIZE=1232 0 0 4 0 313 SMTP - - - -
2012-03-29 11:53:07 65.55.37.88 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(COL0-MC2-F37)+Unfortunately,+some+messages+from+195.188.250 .172+weren't+sent.+Please+try+again.+We+have+limit s+for+how+many+messages+can+be+sent+per+hour+and+p er+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 469 SMTP - - - -
2012-03-29 11:53:07 65.55.37.88 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 QUIT - - 0 0 4 0 485 SMTP - - - -

[Ryno]

69 0 2328 SMTP - - - -
2012-03-29 11:16:28 65.55.37.72 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:<Ryan.Fagan@ololprimary.co.uk>+SIZE=1232 0 0 4 0 2328 SMTP - - - -
2012-03-29 11:16:28 65.55.37.72 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(COL0-MC1-F42)+Unfortunately,+some+messages+from+195.188.250 .172+weren't+sent.+Please+try+again.+We+have+limit s+for+how+many+messages+can+be+sent+per+hour+and+p er+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 3234 SMTP - - - -
2012-03-29 11:16:28 65.55.37.72 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 QUIT - - 0 0 4 0 3250 SMTP - - - -
2012-03-29 11:17:07 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+server-8.tower-38.messagelabs.com+ESMTP 0 0 43 0 125 SMTP - - - -
2012-03-29 11:17:07 85.158.137.3 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 125 SMTP - - - -
2012-03-29 11:19:00 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-server-8.tower-38.messagelabs.com 0 0 37 0 112360 SMTP - - - -
2012-03-29 11:19:00 85.158.137.3 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:<Ryan.Fagan@ololprimary.co.uk> 0 0 4 0 112360 SMTP - - - -
2012-03-29 11:19:00 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250+OK 0 0 6 0 112407 SMTP - - - -
2012-03-29 11:19:00 85.158.137.3 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 RCPT - TO:<Peter.Hueck@xma.co.uk> 0 0 4 0 112407 SMTP - - - -
2012-03-29 11:19:00 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250+OK 0 0 6 0 112485 SMTP - - - -
2012-03-29 11:19:00 85.158.137.3 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 DATA - - 0 0 4 0 112485 SMTP - - - -
2012-03-29 11:19:00 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 354+go+ahead 0 0 12 0 112516 SMTP - - - -
2012-03-29 11:20:35 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC4-F22.Bay0.hotmail.com+Sending+unsolicited+commercia l+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited .+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/a...4:14:56+-0700+ 0 0 242 0 172 SMTP - - - -
2012-03-29 11:20:35 65.54.188.126 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 172 SMTP - - - -
2012-03-29 11:20:35 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC4-F22.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 344 SMTP - - - -
2012-03-29 11:20:35 65.54.188.126 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:<Ryan.Fagan@ololprimary.co.uk>+SIZE=27073 0 0 4 0 344 SMTP - - - -
2012-03-29 11:20:35 65.54.188.126 Outbo

[timzim]

If you've just closed off open relay you might have to wait 24 hours until these other servers re-allow you to send them mail.

[2097]

check your mail server on mxtoolbox.com

make sure your not on any blacklists etc . Make sure you close off open relay ( if open ) and then remove your self from the blacklists

Another thing hackers can do is if they obtain an easy account username/password such as User/User they can authenticate against the Exchange.

Id recommend activating Logging on the SMTP to see whos sending out tons of emails !