Lately I have noticed a lot of dead documents sitting in the mail.box area. They are obvious attempts to send mail to a lot of people using our server.
I have noticed that there is an internet User logged on and there isn’t any information on this person except for the IP address.
Has anyone had this problem? Is it a person hijacking our server to send mass emails? Can it be a virus that we are not aware of? Please help, because this problem is starting to overflow.
Thank you.
Subject: Are you seeing NDR’s ?
If it’s NDR’s you’re seeing, someone might be abusing your domain name for sending spam, as explained in the last paragraph of this document: . A solution for this problem can be found here . Same explanation and solution also apply to emails created by viruses somewhere else on the internet, btw.
The internet session is interesting, though. What IP is that user coming from? Anything you know? Is ‘anonymous’ in all ACL’s with ‘no access’?
Subject: RE: Are you seeing NDR’s ?
The IP address is unknown. I don’t know where it is or who is behind that IP.
Another interesting thing… my home server got hijacked and there were 70,000 documents sitting in the mail.box. I was away on vacation and came back to out of control scrolling lines and proccessor usage. It was crazy!!!
I uninstalled it, since it was a trial version. I thought we might be having the same problems here.
Subject: RE: Are you seeing NDR’s ?
I seem to remember seeing that there was a bug in ND6 that ignord the relay restrictions seetings after an upgrade? Anybody else know about this?
I would encourage you to resolve this as soon as possible so your server does not get put on a spam blackilist, which can be frustrating if not next to impossible to remedy.
Subject: How is your configuration document?
I guess you have applied the correct anti relay settings in the server configuration document? In the configuration document, go to the tab Router/SMTP, Restrictions & Controls, SMTP Inbound Controls, the section Inbound Relay Controls (at the top). I’ve put a * in the second and fourth field:
Inbound Relay controls
Allow messages to be sent only to the following external internet domains:
Deny messages to be sent to the following external internet domains: (* means all)
Allow messages only from the following internet hosts to be sent to external internet domains:
Deny messages from the following internet hosts to be sent to external internet domains:(* means all)
With these controls set, unwanted relay should be impossible.
Subject: RE: How is your configuration document?
Ours doesn’t have a * in the last field.Do you think it can be a virus?? We did get the W32.netsky virus about a week ago.
McAfee got rid of it…
The netsky searches hard drives for email addresses then sends the virus to those email addresses…
Pleas help… Thanks
Subject: RE: How is your configuration document?
What do you have in the last field? If it is empty, it seems that you may have inadvertantly left the floddgates open.
Subject: RE: How is your configuration document?
Hey Mike,
You don’t need a * in both of those fields; only in one of them. The norm is to use only the first one (the one that denies based on destination), as it sounds you already have done. However, putting a * in both sure can’t hurt!
Bruce
Subject: RE: How is your configuration document?
I talked to the Admin, and he says it is just one of those things because of one “big wig” we need to leave it open cause that big wig needs to relay messages through our server.
So I just delete as I go… Kinda inefficient. Ohwell, job security is nice!!!
Subject: RE: How is your configuration document?
Hi,
after each change of such important settings it is nice do perform a real test if your server is not a “open relay”.
There are many web sites where you can trigger such a test for free.Search for “open relay test” on the web or try this one:
Look in you log database in the mail routing events. You should be able to find out from where all the e-mails came from. Post some lines from this help in case that you cant figure it out.
Bye
Hynek
Subject: RE: How is your configuration document?
I am sorry, I shouldn’t of called him a ‘big wig’. He accesses his email through the internet most of the times cause he is in sales/on the road.I guess it is a catch 22… if we close it then he/they can’t get email… but if we leave it open, we are subject to relay problems.
Thank you everyone for your advice
Subject: RE: How is your configuration document?
Does he have a laptop? if so, put the Notes client on it and there is not an issue (unless of course you have firewall issues).
Subject: That’s two different things. (corrected typo)
There’s no need for leaving your server open for relay because of someone on the road. Accessing an email database is not the same as allowing inbound SMTP relay. Like others said, if he’s got a Notes client on a laptop, you can close down relay and have him read and send mail anyway. Or, as an alternative, provide him with iNotes web access to do that.
You can’t afford to leave relay open. If you’re blacklisted by spamhaus, spamcop or one of the likes, you will not be able to send mail to a lot of other companies.
Subject: Don’t compromise your security…
Don’t compromise your security…
…for anyone! No matter what the server function or who the connecting machine/person is, security, including spam, is THE most important aspect when setting up a server on the internet. Secure the server first, Domino is king in this area, then worry about your users. It’s far easier and quicker to accommodate your users in a secure environment than it is to clean up the big mess left by spam and blacklisting.
Regards
Subject: RE: Don’t compromise your security…
and blaclisting is a ruddy pain. An IP address assigned to one of my mail servers by a host company was on a blacklist because of the previous owner of the IP address. I only found out because one newspaper I work with (I write for them occassionally) started using a blacklist that started blocking my mail. Long story short, I just had the IP address changed as the path of least pain because the Blacklister was notorious for never removing an entry that should not be listed (anymore).
Subject: 55%
You know, we block over 55% of our incoming mail because of two things: we check if the intended recipient actually exists in the Domino directory, and we use blacklists. Personally I’m glad we can stop that deluge before it hits our servers. Especially because we hardly ever have a complaint. A large Dutch ISP got blacklisted once, that gave some trouble 
Subject: RE: How is your configuration document?
Hi,
if you have users who need to relay mail through your server then use the following settings for them:
Exceptions for authenticated users:
Allow all authenticated users to relay
This way ONLY authenticated users will be allowed to relay mail but all others wont.
This works fine and the only settings your users need to do is to use an authentication for their SMTP-server settings.
Bye
Hynek
Subject: Mike - please do what Hynek says above!
This field is new in R6, so Joe wouldn’t have been able to do this when you guys were on R5.
Subject: RE: Mike - please do what Hynek says above!
Bruce, we did that and we are still getting a few relayed messages. Is there anyway to stop this using rules?
Subject: RE: Mike - please do what Hynek says above!
Even after restarting the server?
By “getting a few relayed messages,” do you mean that you’re receiving messages relayed by someone else’s box, or do you mean that you’re getting NDRs from other servers telling you that they’re rejecting mail you relayed to them?