Exchange Server Forums

NDR Attack

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> Exchange 2003 SBS >> NDR Attack

Page: [1]

Message

<< Older Topic Newer Topic >>

NDR Attack - 14.Oct.2011 5:37:57 AM

markikona

Posts: 4
Joined: 22.Nov.2010
Status: offline

Hi,

Running Exchange 2003 in SBS 2003 and am suffering from what appears to be a reverse NDR atatck.

I have followed all of the guidelines here

http://support.microsoft.com/kb/886208

I have also set sender and recipient filer to block postmaster@<mydomain> and I have turned off NDRs.

I am still getting a large number of messages in my SMTP queue the sender is postmaster@<mydomain> and the recipient is the same.

I have also followed all of the steps here http://support.microsoft.com/default.aspx?scid=kb;EN-US;324958 to ensure that the server is not an open relay.

I'm really stuck as to what i can do to resolve this other than sit there all day deleting messages!

Can anyone offer eny help?

TIA

Mark

Post #: 1

Featured Links*

RE: NDR Attack - 14.Oct.2011 6:54:54 AM

alanhardisty

Posts: 386
Joined: 28.Feb.2010
Status: offline

If you are sending mail from Postmaster@yourdomain.com, then you need to Enable Recipient Filtering:

http://www.msexchange.org/tutorials/Sender-Recipient-Filtering.html

Also - good anti-spam software would handle this without breaking sweat and I would recommend you try out Vamsoft ORF:

www.vamsoft.com

_____________________________

Alan Hardisty

http://www.it-eye.co.uk
http://alanhardisty.wordpress.com
http://www.exchange-certificates.com

(in reply to markikona)

Post #: 2

RE: NDR Attack - 14.Oct.2011 8:25:34 AM

markikona

Posts: 4
Joined: 22.Nov.2010
Status: offline

Hi,

thanks for this, I have done the recipient filtering and applied it to my SMTP virtual server but still no joy.

I we have anti spam with Sophos Pure Message, will speak to them and see if they can assist.

thanks

Mark

(in reply to alanhardisty)

Post #: 3