I checked on the system administrator menu for exchnage 5.5 and i do not ahve Internet mail service running, yet I get emails stating my server is an open relay. Is it possible spam filter is open relaying emails?

how do I lock this down on a win2k server running ms exchange v5.5?

Perhaps I misunderstood.   Is Exchange and Spam Filter on the same machine?  What configuration do you have?  SpamFilter should be the very first server in the "Chain" and you must specify the hosted domains.

Regards,

Dan S.

I don't need ms exchnage help, i just need help understanding how spamfilter open relays messages.

I wish to disable or prevent the open relay feature.

the spam filter is acting as a MS Mail gateway to your Exchange server.

John,

In the default configuration (no custom user settings) SpamFilter will *not* accept any emails to relay.

USers will need to specify a list "Local Domains" for which SpamFilter will accept email. Only emails addressed to those local domains will be accepted and then forwarded (relayed) to your destination SMTP server.

Furthermore administrators can setup several "whitelists" of domains, IP, emails, etc. Any sender that appears on the whitelist will be able to relay email thru SpamFilter to your destination SMTP server. Please note that SpamFilter will not relay emails out to the internet, it will simply forward them to the destinatino SMTP server you specify.

If users misconfigure the "Local Domains" by placing too broad of a wildcard in the list, or any other white list as a matter of fact, they will possibly cause SpamFilter to accept emails for all domains, and thus cause it to be an "open relay".

Roberto F.
LogSat Software

If Norton is the first application that receives the email, then you'll want to configure it so that it does not allow relay, since if things are as you described them, it is Norton that is accepting email from the internet and then allowing relay by passing everything to SpamFilter.

Without looking at your logs we can't be 100% certain, but it's likely that SpamFilter sees the emails originating from Norton since it would receive a connection from either the IP Norton is listening on or 127.0.0.1. Since the IP is local to the server SpamFilter will trust it and will proceed to deliver it to your mail server.

Unless Norton is able to pass-thru the original IP address of the sender so that SpamFilter sees it, you will not be able to make use of some of the filtering power SpamFilter uses by applying IP-based filters, like MAPS, reverse DNS, IP-blocking, IP-whitelisting. You'd usually want to place SpamFilter first in line to accept traffic, then forward non-spam emails to your antivirus server, which will then pass them on to your smtp server. This topology will allow SpamFilter to see the original IP of the sender and perform more accurate filtering by using the IP-based rules.

Roberto F.
LogSat Software

Vance,

Can you try stopping SpamFilter, delete the tblServersServerID line from the SpamFilter.ini file, delete the record in the tblServers table in the database containing your server, then restart SpamFilter. If that still does not work, please try following the 3 steps under the Settings tab, QuarantineDB sub-tab.

Roberto F.
LogSat Software