Announcement

Collapse
No announcement yet.

Multiple connections trying to use as Relay

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Multiple connections trying to use as Relay

    Hi all,

    I'm literally getting 3 errors a seconds on my exchange server stating similar to the below -

    Event Type: Error
    Event Source: MSExchangeTransport
    Event Category: SMTP Protocol
    Event ID: 7010
    Date: 10/06/2008
    Time: 12:02:30
    User: N/A
    Computer: MX
    Description:
    This is an SMTP protocol log for virtual server ID 1, connection #4012. The client at "121.35.4.55" sent a "rcpt" command, and the SMTP server responded with "550 5.7.1 Unable to relay for [email protected] ". The full command sent was "rcpt TO:<[email protected]>". This will probably cause the connection to fail.
    For more information, click http://www.microsoft.com/contentredirect.asp.


    Now to my knowledge it's good that messages can't relay because that means I'm not an open realy, but how can I stop these messages?

    I've also got multiple IP's connected to the exchange server shown in Default SMTP Virtual Server current sessions???

  • #2
    Re: Multiple connections trying to use as Relay

    Looks like someone is trying to attack your server.
    Do you have any relay options enabled? Authenticated relaying for example? If so, disable it, as it isn't required for normal use.

    The log you are getting shows that Exchange is working correctly. Turn down diagnostic logging on the SMTP protocol.

    Simon.
    --
    Simon Butler
    Exchange MVP

    Blog: http://blog.sembee.co.uk/
    More Exchange Content: http://exchange.sembee.info/
    Exchange Resources List: http://exbpa.com/
    In the UK? Hire me: http://www.sembee.co.uk/

    Sembee is a registered trademark, used here with permission.

    Comment


    • #3
      Re: Multiple connections trying to use as Relay

      Hi again Sembee,

      How can I stop them attacking my server, it's slowing it down?

      I have confirgure exchange like these settings http://www.msexchange.org/tutorials/MF005.html

      Comment


      • #4
        Re: Multiple connections trying to use as Relay

        Use your firewall to block thier IP, that is the simplest solution.

        Comment


        • #5
          Re: Multiple connections trying to use as Relay

          If you can see what IP addresses they are coming from then you could block them at the firewall. I would ensure that you server is configured to protect you, with recipient filtering, tar pit etc (if Exchange 2003). If someone is having an attack on your server you may end up having to simply unplug the server from the internet until it stops.

          Simon.
          --
          Simon Butler
          Exchange MVP

          Blog: http://blog.sembee.co.uk/
          More Exchange Content: http://exchange.sembee.info/
          Exchange Resources List: http://exbpa.com/
          In the UK? Hire me: http://www.sembee.co.uk/

          Sembee is a registered trademark, used here with permission.

          Comment


          • #6
            Re: Multiple connections trying to use as Relay

            thanks Sembee.

            Comment

            Working...
            X