Exchange server 2003

[sukh]

I assume sendin gout emails to other domain are fine?

Can you check the domain on MXtoolbox and see what that report, i.e blacklists/open relay etc...

[Ryno]

The school is listed on a few blacklists. The relay is now closed iv also disabled accounts we dont use. How do i remove us off the blacklist?.

[PiqueABoo]

Another thing hackers can do is if they obtain an easy account username/password such as User/User they can authenticate against the Exchange.

Last case I saw did precisely that: Exchange 2003 was set to allow authenticated users to relay from anywhere in the world and one of their users apparently had a rubbish password. Security log was full of zillions of events for that specific user logging on (in two minds about how they got the credentials, but if there were clues in the event logs wrap round had long since vanished them).

[sukh]

For the blacklist, yu will have to contact each and check the process with them it can take some time.

[Ryno]

The smtp says

220 ololprimary.co.uk Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Thu, 29 Mar 2012 14:00:30 +0100
DNS Lookup failed.
Does not support TLS.
0 seconds - Good on Connection time
Not an open relay.
4.618 seconds - Good on Transaction time


and the blacklist says

BARRACUDA LISTED DetailReturn codes were: 127.0.0.2 105 16
IMP-SPAM LISTED DetailReturn codes were: 127.0.0.5 105 16
INPS.DE LISTED DetailReturn codes were: 127.0.0.2 15 16
LASHBACK LISTED DetailReturn codes were: 127.0.0.2 1902 16
PSBL LISTED DetailReturn codes were: 127.0.0.2 397 31
UCEPROTECTL1 LISTED DetailReturn codes were: 127.0.0.2 390 16
ivmSIP LISTED DetailReturn codes were: 127.0.0.2 401 62

[sukh]

I just done a look up and it's fine. No blacklists.

Can you change DNS servers used by your ISP?

[Ryno]

im not sure as we are in with the local council which is sefton. How would i find this information out?

[2097]

as shown above , your mail server is on quite a few blacklists

Setting Relay Restrictions

Set the relay restrictions to the internal network only .

Set the SMTP log level up ( better to check it now before you try and unblock yourself from the spam lists )

Check the logs and see what PC's or accounts are authenticating and sending etc.

We use GFI mail essentials , i noticed we had a authenticated relay attack last summer when our server sent out around 1000 emails and got us blacklisted ! .

[sukh]

Can you check a few of the messages in the queue and check the headers to see who the sender/receiver is? ANd checlk IP info

[Ryno]

There is no messages in the queue no more as these have all gone. But when there is one all it says is An SMTP protocol error occurred. This is on genuine emails from staff within the school.

[sukh]

Sorry, do you actually still have a issue now or not?

[Ryno]

yer still no joy on sending emails tried again this morning there is a few messages in the que but its postmaster send failed to deliver emails but even they are not leaving.

[timzim]

24hrs is not yet up since you closed your open relay!

[Ryno]

All sorted now!!!! Turned off all services deleted smtp protocol and the connector reset them up then started all services and its all up and running. I want to say thank you to everyone for there help!!!

[2097]

Glad its all sorted .

Pain in the bloody arse Exchange is when it dont work properly.

What makes you laugh is , before you started there they must have had such a lot of problems with exchange ! , make sure they know you sorted it out for them with a nice staff email explaining .