KB 151

How do I configure an MS Exchange server to not allow relaying?

Article:151
Created:2002-01-25 11:26:21
Categories:
  E-mail
  Security

Question or Symptom

I've got an MS Exchange server and it's apparently been used to relay spam. Do you have any information about how to configure it to not do this?

Resolution

With versions of Exchange Server below 5.0 it is impossible to configure the server to be a secured relay. If your Exchange Server version is below version 5.0 the recommended path is to upgrade to at least Exchange server 5.5 Service Pack 2 with the encapsulated SMTP relay address patch.

There are several links listed below. The first is a third-party service where you can go to their website, plugin the IP address of your mailserver, and it will run a test to see if your mail server is misconfigured.

If your mail server accepts the test message that the automated test tries to relay through it, the test will report that your mail server is an open relay. This does indicate that your server is misconfigured, but it might not be true that your server is relaying.

If a mail server is configured properly, when someone, including this test, tries to relay through it, the mail server should refuse to accept the message. A common misconfiguration is for the mail server to accept the mail, then bounce it. This is better than relaying, but it is still a problem that needs to be fixed. To a spammer, that server will look like an open relay, and they will deliver hundreds, thousands, perhaps millions of messages to it, that it will then have to bounce. This will obviously affect the performance of your mail server. A second issue with this misconfiguration is that you can be used in a denial of service attack against someone else.

The links following the link for the open relay test are all articles on how to properly configure a MS Exchange server. They explain both how to prevent your Exchange server from being an open relay, and how to fix the "accept/bounce" misconfiguration.

Related URLS

 http://www.mail-abuse.com/an_sec3rdparty.html
 http://www.microsoft.com/technet/security/bulletin/fq99-027.asp
 http://www.exchangeadmin.com/Articles/Index.cfm?ArticleID=7696
 http://nocops.pacific.net.sg/serviceLink/mailrelaycheck.html