Exchange Server Forums

SMTP Issue or Spam?

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> Message Routing >> SMTP Issue or Spam?

Page: [1]

Message

<< Older Topic Newer Topic >>

SMTP Issue or Spam? - 18.Oct.2006 12:11:45 AM

hkboy

Posts: 15
Joined: 18.Apr.2005
From: Hong Kong
Status: offline

Hello all,
Exchange 2003, Windows 2003, all updated to the latest SPs.

We are having a strange issue. One of the users daily recieve a message from himself but it contains a spam message in the body text for some email marketing website.
for example the message is sent from user1@domain.com to user1@domain.com . where sender and recipient are same and return path is also same. there is no subject but the message body contains a spam email marketing stuff.

Checked in the message tracking centre on exchange, the message is submitted by the exchange smtp itself.

The server is closed relay so do not know what is happening here.

Please help.

thanks

Post #: 1

Featured Links*

RE: SMTP Issue or Spam? - 18.Oct.2006 10:40:51 AM

uemurad

Posts: 8232
Joined: 7.Jan.2004
From: California, USA
Status: offline

If the body of the message looks like spam, then that's what it is.

The message is spoofed - meaning the sending address doesn't represent the actual sender. This is a common spam tactic. Using a sending address with the same domain can defeat some filters, as systems aren't always looking to block messages from their own domain.

You can ask yourself then if it is logical that a message from your domain can come to you from the outside world (Internet). Typically that answer is no. You can take steps at your gateway to stop this, however many legitimate services spoof messages to make it look like an alert or announcement is coming from your own systems. In those cases you'll need to explicitly allow them in.

Sound like an endless loop? Welcome to the wonderful world of spam fighting!

_____________________________

Regards,

Dean T. Uemura
Microsoft MVP - Exchange (2007-2011)
exchangeguy.blogspot.com
uemurad@yahoo.com

(in reply to hkboy)

Post #: 2

RE: SMTP Issue or Spam? - 18.Oct.2006 10:45:05 AM

jchong

Posts: 2516
Joined: 1.Dec.2005
From: Centreville, Virginia
Status: offline

What you can do to circumvent this is,

Go to ESM, Global Settings, Sender Filtering. Block messages that claim
to be from the following senders: add your domain ie. @yourdomain.com.
This will prevent you from receiving messages spoofed as your own
domain. Make sure that this is applied in your SMTP Virtual Server
setting. However, make sure you're not doing anything like SMTP namespace sharing that may be sending as your domain to your Exchange org. Usually your SPAM app should catch this.

_____________________________

James Chong
MCSE | M+, S+, MCTS, Security+
msexchangetips.blogspot.com

(in reply to hkboy)

Post #: 3