Exchange 2000 :: NDR problems causing big queues

feenster99 · 17 Mar 2008 at 15:05

Hi all,
I've got a customer using SBS 2000 on their Server. They are receiving lots of spam to non-existent addresses - every time one of these bits of mail is received, it generates an NDR which then sits in an Exchange queue. The problem is, these queues can be number in their 100's, and the mail never leaves. This slows down the sending of any outgoing mail.

Has anyone experienced this before, and is there a way around it?

Cheers,
Matt

#Chri5# · 17 Mar 2008 at 17:31

Sounds like a Reverse NDR "attack". IIRC, the Microsoft fix for it came in Exchange 2000.

Not much help as a long term fix but see http://support.microsoft.com/kb/909005

Googling Reverse NDR attack will turn up lots of articles.

superplay · 17 Mar 2008 at 17:33

This is a common problem.

The general way around this is to enabale the option "Filter Recipients who are not in the directory" Global Settgins / Message Delivery / recipient filtering

However remember that this will also stop any relaying that you may allow on the server.

In addition to this there are also discussions that this option may actually make it easier for spammers to identify valid addresses in your domain by bulk emailing the server and waiting on the results. Forgot to mention that I genreally setup a SMTP tarpit when I enable this.

http://support.microsoft.com/kb/842851/

feenster99 · 17 Mar 2008 at 22:06

Thanks guys, i'll take a look tomorrow at work.

Matt