Exchange server 2003

sukh · March 29, 2012

any chance of you PM me the SMTP logs?

If they are huge either zip or cut n past a section

Ryno · March 29, 2012

oting.aspx#errors. 0 0 255 0 390 SMTP - - - -

2012-03-29 11:53:02 65.55.92.152 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+SNT0-MC2-F23.Snt0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:23+-0700+ 0 0 242 0 125 SMTP - - - -

2012-03-29 11:53:02 65.55.92.152 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 125 SMTP - - - -

2012-03-29 11:53:02 65.55.92.152 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-SNT0-MC2-F23.Snt0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 266 SMTP - - - -

2012-03-29 11:53:02 65.55.92.152 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 266 SMTP - - - -

2012-03-29 11:53:02 65.55.92.152 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(SNT0-MC2-F23)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 407 SMTP - - - -

2012-03-29 11:53:03 65.55.92.168 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+SNT0-MC3-F11.Snt0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:24+-0700+ 0 0 242 0 125 SMTP - - - -

2012-03-29 11:53:03 65.55.92.168 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 125 SMTP - - - -

2012-03-29 11:53:03 65.55.92.168 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-SNT0-MC3-F11.Snt0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 250 SMTP - - - -

2012-03-29 11:53:03 65.55.92.168 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 250 SMTP - - - -

2012-03-29 11:53:03 65.55.92.168 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(SNT0-MC3-F11)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 375 SMTP - - - -

2012-03-29 11:53:03 65.54.188.94 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC2-F15.Bay0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:24+-0700+ 0 0 242 0 171 SMTP - - - -

2012-03-29 11:53:03 65.54.188.94 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 171 SMTP - - - -

2012-03-29 11:53:03 65.54.188.94 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC2-F15.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 328 SMTP - - - -

2012-03-29 11:53:03 65.54.188.94 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 328 SMTP - - - -

2012-03-29 11:53:03 65.54.188.94 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(BAY0-MC2-F15)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 500 SMTP - - - -

2012-03-29 11:53:04 65.54.188.110 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC3-F31.Bay0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:25+-0700+ 0 0 242 0 156 SMTP - - - -

2012-03-29 11:53:04 65.54.188.110 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 156 SMTP - - - -

2012-03-29 11:53:04 65.54.188.110 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC3-F31.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 312 SMTP - - - -

2012-03-29 11:53:04 65.54.188.110 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 312 SMTP - - - -

2012-03-29 11:53:04 65.54.188.110 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(BAY0-MC3-F31)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 469 SMTP - - - -

2012-03-29 11:53:04 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC4-F37.Bay0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:25+-0700+ 0 0 242 0 172 SMTP - - - -

2012-03-29 11:53:04 65.54.188.126 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 172 SMTP - - - -

2012-03-29 11:53:04 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC4-F37.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 328 SMTP - - - -

2012-03-29 11:53:04 65.54.188.126 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 328 SMTP - - - -

2012-03-29 11:53:04 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(BAY0-MC4-F37)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 484 SMTP - - - -

2012-03-29 11:53:06 65.54.188.72 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC1-F32.Bay0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:26+-0700+ 0 0 242 0 156 SMTP - - - -

2012-03-29 11:53:06 65.54.188.72 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 156 SMTP - - - -

2012-03-29 11:53:06 65.54.188.72 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC1-F32.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 328 SMTP - - - -

2012-03-29 11:53:06 65.54.188.72 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 328 SMTP - - - -

2012-03-29 11:53:06 65.54.188.72 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(BAY0-MC1-F32)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 484 SMTP - - - -

2012-03-29 11:53:06 65.55.37.104 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+COL0-MC3-F34.Col0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:27+-0700+ 0 0 242 0 156 SMTP - - - -

2012-03-29 11:53:06 65.55.37.104 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 156 SMTP - - - -

2012-03-29 11:53:06 65.55.37.104 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-COL0-MC3-F34.Col0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 312 SMTP - - - -

2012-03-29 11:53:06 65.55.37.104 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 312 SMTP - - - -

2012-03-29 11:53:06 65.55.37.104 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(COL0-MC3-F34)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 468 SMTP - - - -

2012-03-29 11:53:07 65.55.37.88 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+COL0-MC2-F37.Col0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:27+-0700+ 0 0 242 0 157 SMTP - - - -

2012-03-29 11:53:07 65.55.37.88 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 157 SMTP - - - -

2012-03-29 11:53:07 65.55.37.88 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-COL0-MC2-F37.Col0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 313 SMTP - - - -

2012-03-29 11:53:07 65.55.37.88 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 313 SMTP - - - -

2012-03-29 11:53:07 65.55.37.88 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(COL0-MC2-F37)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 469 SMTP - - - -

2012-03-29 11:53:07 65.55.37.88 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 QUIT - - 0 0 4 0 485 SMTP - - - -

Ryno · March 29, 2012

69 0 2328 SMTP - - - -

2012-03-29 11:16:28 65.55.37.72 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 2328 SMTP - - - -

2012-03-29 11:16:28 65.55.37.72 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(COL0-MC1-F42)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 3234 SMTP - - - -

2012-03-29 11:16:28 65.55.37.72 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 QUIT - - 0 0 4 0 3250 SMTP - - - -

2012-03-29 11:17:07 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+server-8.tower-38.messagelabs.com+ESMTP 0 0 43 0 125 SMTP - - - -

2012-03-29 11:17:07 85.158.137.3 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 125 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-server-8.tower-38.messagelabs.com 0 0 37 0 112360 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM: 0 0 4 0 112360 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250+OK 0 0 6 0 112407 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 RCPT - TO: 0 0 4 0 112407 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250+OK 0 0 6 0 112485 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 DATA - - 0 0 4 0 112485 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 354+go+ahead 0 0 12 0 112516 SMTP - - - -

2012-03-29 11:20:35 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC4-F22.Bay0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:14:56+-0700+ 0 0 242 0 172 SMTP - - - -

2012-03-29 11:20:35 65.54.188.126 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 172 SMTP - - - -

2012-03-29 11:20:35 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC4-F22.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 344 SMTP - - - -

2012-03-29 11:20:35 65.54.188.126 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=27073 0 0 4 0 344 SMTP - - - -

2012-03-29 11:20:35 65.54.188.126 Outbo

timzim · March 29, 2012

If you've just closed off open relay you might have to wait 24 hours until these other servers re-allow you to send them mail.

1.1k · March 29, 2012

check your mail server on mxtoolbox.com

make sure your not on any blacklists etc . Make sure you close off open relay ( if open ) and then remove your self from the blacklists

Another thing hackers can do is if they obtain an easy account username/password such as User/User they can authenticate against the Exchange.

Id recommend activating Logging on the SMTP to see whos sending out tons of emails !

sukh · March 29, 2012

I assume sendin gout emails to other domain are fine?

Can you check the domain on MXtoolbox and see what that report, i.e blacklists/open relay etc...

Ryno · March 29, 2012

The school is listed on a few blacklists. The relay is now closed iv also disabled accounts we dont use. How do i remove us off the blacklist?.

PiqueABoo · March 29, 2012

Another thing hackers can do is if they obtain an easy account username/password such as User/User they can authenticate against the Exchange.

Last case I saw did precisely that: Exchange 2003 was set to allow authenticated users to relay from anywhere in the world and one of their users apparently had a rubbish password. Security log was full of zillions of events for that specific user logging on (in two minds about how they got the credentials, but if there were clues in the event logs wrap round had long since vanished them).

sukh · March 29, 2012

For the blacklist, yu will have to contact each and check the process with them it can take some time.

Ryno · March 29, 2012

The smtp says

220 ololprimary.co.uk Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Thu, 29 Mar 2012 14:00:30 +0100

DNS Lookup failed.

Does not support TLS.

0 seconds - Good on Connection time

Not an open relay.

4.618 seconds - Good on Transaction time

and the blacklist says

BARRACUDA LISTED DetailReturn codes were: 127.0.0.2 105 16

IMP-SPAM LISTED DetailReturn codes were: 127.0.0.5 105 16

INPS.DE LISTED DetailReturn codes were: 127.0.0.2 15 16

LASHBACK LISTED DetailReturn codes were: 127.0.0.2 1902 16

PSBL LISTED DetailReturn codes were: 127.0.0.2 397 31

UCEPROTECTL1 LISTED DetailReturn codes were: 127.0.0.2 390 16

ivmSIP LISTED DetailReturn codes were: 127.0.0.2 401 62

sukh · March 29, 2012

I just done a look up and it's fine. No blacklists.

Can you change DNS servers used by your ISP?

Ryno · March 29, 2012

im not sure as we are in with the local council which is sefton. How would i find this information out?

1.1k · March 29, 2012

as shown above , your mail server is on quite a few blacklists

Setting Relay Restrictions

Set the relay restrictions to the internal network only .

Set the SMTP log level up ( better to check it now before you try and unblock yourself from the spam lists )

Check the logs and see what PC's or accounts are authenticating and sending etc.

We use GFI mail essentials , i noticed we had a authenticated relay attack last summer when our server sent out around 1000 emails and got us blacklisted ! .

sukh · March 29, 2012

Can you check a few of the messages in the queue and check the headers to see who the sender/receiver is? ANd checlk IP info

Ryno · March 29, 2012

There is no messages in the queue no more as these have all gone. But when there is one all it says is An SMTP protocol error occurred. This is on genuine emails from staff within the school.

sukh · March 29, 2012

Sorry, do you actually still have a issue now or not?

Ryno · March 30, 2012

yer still no joy on sending emails tried again this morning there is a few messages in the que but its postmaster send failed to deliver emails but even they are not leaving.

timzim · March 30, 2012

24hrs is not yet up since you closed your open relay!

Ryno · March 30, 2012

All sorted now!!!! Turned off all services deleted smtp protocol and the connector reset them up then started all services and its all up and running. I want to say thank you to everyone for there help!!!

1.1k · March 30, 2012

Glad its all sorted .

Pain in the bloody arse Exchange is when it dont work properly.

What makes you laugh is , before you started there they must have had such a lot of problems with exchange ! , make sure they know you sorted it out for them with a nice staff email explaining .

Ryno · March 30, 2012

I no learned loads about exchange now haha. Yer they said exchange has never worked correct haha wonder why. Surprised we aint black listed the amount of emails that were in the queue.

1.1k · April 2, 2012

Well the lists did say you was blacklisted on 4 lists .

The previous tech has probally never requested to be removed , IRC you can only ask a few times !

So make sure everything is closed up , all holes etc before you request removal .

Exchange server 2003

Recommended Posts

sukh

Ryno

Ryno

timzim

2097

sukh

Ryno

PiqueABoo

sukh

Ryno

sukh

Ryno

2097

sukh

Ryno

sukh

Ryno

timzim

Ryno

2097

Ryno

2097

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

iOS 27 BYOD and Smoothwall web filtering - Connectivity Assist causing issues?

3rd Party Warranty on Existing Panels

Edge Auto Sign in Broken / Cloud Filter

Home

Forums

What's New