Exchange

sparkite

We use exchange on sbs2003 for our email. One user using our public email address (info@XXXXXX.com is getting spam from "herself".

It would seem that the messages are being spoofed and appear to be from her account but are actually not.

What can I do to stop these messages? I have enabled spam filter control in exchange but this has not stopped this spam (although it has stopped other spam mail"

Is it possible to filter a sender and apply this to a certain mailbox only?

Any help would be appreciated.

Biggins

Are you allowed install an alternative email tool?

I use "Windows Live Mail" for all my separate mail accounts.
It allows me to clock mails individually and in block. Has a great automatic spam detection filter tool in it too.
You can also select/deselect items marked as one or the other in the wrong easily.
Also allows you to block by address, name and by i.p. as well.

Worth a try to see will it suit - and its free.

http://download.live.com/wlmail

sparkite

Unfortunately changing mail client is not an option but thank you for the suggestion.

snollup

that sounds a little more than spam. is her pc infected with something? is she running anti-virus?

sparkite

Thanks for the suggestion but we have scanned with AV and antispyware and the PC has been reloaded recently due to another issue.

horgan_p

i would try to find the originating email ip address, is it external or is it coming from the exchange server itself - or from inside the building.

I had a similar nightmare , i cant remember the exact solution , but i know it involved setting up a new default smtp server , and filtering the mail from one to the other.
sorry i cant remember properly , but i had to log a call with microsoft in the end to sort it out.

brianwalshcork

Create DNS SPF records (sender policy framework) for your mail servers, the configure sender ID filtering in exchange.

SPF records tell the receiving mail server (in this case your server) which hosts/IP addresses are authorised to send email on behalf of your domain. Since the emails with the spoofed addresses are (most likely) not coming from your server (if they are you've got other problems to worry about!) they will be rejected.

There's a record creation wizard and general info here: www.openspf.org

This describes your problem exactly: http://www.petri.co.il/sender_policy_framework.htm

more info: http://www.msexchange.org/tutorials/Sender-Policy-Framework.html [this says that exchange doesn't support SPF, but it does since 2003 SP2 - if not SP1]

sparkite

Thanks guys. I will give this a go.

Villain

Failing that you can use a third party filter, one that really works that is, should be nothing more than a few hundred Euro for the year depending on number of mailboxes. These will block 90% of Spam including spoofing emails like you have described. They have the added feature as acting as an MX backup should your server or internet connection go down.

brianwalshcork

+1 on the third party software - I don't know about others, but 92% of incoming mail through one of my servers is being detected as spam, (more than this is actually spam).

1/2 of that is sent to invalid addreses, so wouldn't end up in users mailboxes, but that still leaves a ratio of 1:5 between good emails and bad. This wastes users time deleting spam; means they will ignore new mail notifications; Outlook web access users won't bother checking their email; and mobile access users' bandwidth is wasted.

I use GFI MailEssentials and find it pretty good - it pays for itself by keeping all that spam from the users, and when properly tuned has zero false positives. (It's not all rosy though - it could do with better reporting)