Just a quick heads up for Domino admins who are using SMTP AUTH to permit users to relay through their servers.
This refers to the server configuration field “Exceptions for authenticated users:” set to value “Allow all authenticated users to relay” (default is “Perform anti-relay checks for authenticated users”).
A rapidly growing category of abuse is brute force attacks against ESMTP hosts which return 250-AUTH LOGIN following EHLO, to obtain a valid username/password pair. These usernames/passwords are then used by spammers to authenticate and then relay through compromised hosts.
We are seeing a large and increasing volume of these things here at the moment and although most are from compromised Exchange servers (which relay without restriction by default for authenticated users), a few sightings are available of Domino hosts that have been similarly compromised.
If you are using SMTP authentication, and permitting authenticated users to relay without restriction, you need to enforce a strong password policy now!
Chris Linfoot