How to help prevent your Exchange Server 5.5 computer from being used as a relay to deliver spam e-mail (893518)


The information in this article applies to:

  • Microsoft Exchange Server 5.5

SUMMARY

Users can use an e-mail server's non-delivery report (NDR) feature to send unsolicited commercial e-mail (spam). This article describes how to configure Microsoft Exchange Server 5.5 to prevent someone from using your e-mail server's NDR feature to send spam.

To help prevent the delivery of spam, you can configure your e-mail server to prevent the delivery of NDR e-mail to specified addresses. To do this, configure message filtering on the Connections tab of your Internet Mail Service connector. On the Connections tab, you can also configure IP address rejection to stop all unsolicited e-mail.

Additionally, third-party tools are available to continuously monitor and to prevent spam from affecting the performance of your Exchange server.

INTRODUCTION

This article describes two ways to configure Exchange Server 5.5 to stop external users from trying to use the NDR feature of your e-mail server to send spam. Senders of spam can use the NDR feature of e-mail servers to send spam to recipients. This kind of incident is known as a reverse NDR attack.

To prevent someone from using your e-mail server's NDR feature to send spam, you can set up message filtering. Or, you can reject specific IP addresses in Exchange Server 5.5.

Additionally, this article briefly describes to two other methods to help prevent spam. These two other methods are modifying the registry and using third-party tools.
The methods that you use to help control unsolicited e-mail depend on your Exchange organization and on your environment. To prevent users outside your Exchange organization from using the NDR feature of your Exchange Server 5.5 server to deliver spam, use one or both of the following methods:
  • Enable message filtering. To do this, you use the Connections tab of the Internet Mail Service connector.
  • Reject specific IP addresses. To do this, you use the Connections tab of the Internet Mail Service connector.
Note These two methods require constant monitoring and updating. The updating and the monitoring cause high administrative cost.

Or, you can use one of the following two methods instead. The following methods have lower administrative cost:
  • Modify the registry.
  • Use third-party tools.

Enable message filtering

To enable message filtering, you must install Exchange Server 5.5 Service Pack 2 (SP2) or a later version of Exchange Server 5.5 . This feature is available in the latest service pack for Microsoft Exchange Server 5.5. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

191014 How to obtain the latest Exchange Server 5.5 service pack

You can enable message filtering to delete messages or to move messages. You can filter messages from specific e-mail addresses or from specific e-mail domains. Enabling this feature stops the delivery of ordinary e-mail and of NDR e-mail to addresses or to domains that you specify. Additionally, you can filter messages that have blank From boxes.

Filter e-mail that is sent to a specific e-mail address

  1. Start Exchange System Manager.
  2. Expand Your_Site_Name.
  3. Click Connections, and then double-click Internet Mail Service (Your_Server_Name).
  4. Click Connections.
  5. In the Accept Connections section, click Message Filtering.
  6. Click Add.
  7. In the Domain/User box, type the e-mail address. Then, click OK. For example, type someone@example.com, and then click OK.
  8. Click to select or to clear the Delete messages instead of moving to the Turf directory check box. If you click to select the check box, the messages are deleted. If you click to clear the check box, the messages are stored in a separate folder that is named Turfdir.
  9. Click OK two times.
  10. Quit Exchange System Manager.

Filter e-mail that is sent to a specific e-mail domain

  1. Follow steps 1 through 6 of the "Filter e-mail that is sent to a specific e-mail address" section of this article.
  2. In the Domain/User box, type the domain. Then, click OK. For example, type example.com, and then click OK.
  3. Click to select or to clear the Delete messages instead of moving to the Turf directory check box. If you click to select the check box, the messages are deleted. If you click to clear the check box, the messages are stored in a separate folder that is named Turfdir.
  4. Click OK two times.
  5. Quit Exchange System Manager.

Filter messages that have blank From boxes

  1. Follow steps 1 through 6 of the "Filter e-mail that is sent to a specific e-mail address" section of this article.
  2. In the Domain/User box, type a period. Then, click OK. That is, type ., and then click OK.
  3. Click to select or to clear the Delete messages instead of moving to the Turf directory check box. If you click to select the check box, the messages are deleted. If you click to clear the check box, the messages are stored in a separate folder that is named Turfdir.
  4. Click OK two times.
  5. Quit Exchange System Manager.

Reject specific IP addresses

You can reject e-mail from specific IP addresses if you know the source of unsolicited e-mail. To do this, follow these steps:
  1. Start Exchange System Manager.
  2. Expand Your_Site_Name.
  3. Click Connections, and then double-click Internet Mail Service (Your_Server_Name).
  4. Click Connections.
  5. In the Accept Connections area, click Specify by Host.
  6. Click Add.
  7. In the IP address box, type the IP address that is the source of the e-mail messages that you want to reject. That is, type xxx.xxx.xx.xx, where xxx.xxx.xx.xx is the IP address of a sender of spam.
  8. In the Mask box, type the subnet mask for the IP address that you entered in step 7. That is type, xxx.xxx.xx.xx where xxx.xxx.xx.xx is the subnet mask for the IP address that you entered in step 7.
  9. Click Reject connection from this host.
  10. Click OK three times.
  11. Quit Exchange System Manager.

Modify the registry

Additionally, you can use a registry feature in Exchange Server 5.5 to suppress NDR e-mail. For more information about how to control NDRs in Exchange Server 5.5, click the following article number to view the article in the Microsoft Knowledge Base:

837794 An update is available in Exchange Server 5.5 to control whether the Internet Mail Service suppresses or delivers NDRs

Use third-party tools

Message filtering and IP address rejection measures require constant monitoring and updating. There are third-party tools that can perform similar tasks with a lower administrative cost.

REFERENCES

For additional information about how to control NDRs in Exchange 2000 Server or in Exchange Server 2003, click the following article number to view the article in the Microsoft Knowledge Base:

294757 How to control non-delivery reports when you use Exchange 2000 or Exchange 2003

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.
Modification Type:MajorLast Reviewed:3/24/2005
Keywords:kbhowto KB893518
©2004 Microsoft Corporation. All rights reserved.