|
Home > Archive > IIS and SMTP > May 2004 > Block Incoming SMTP Spam
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
Block Incoming SMTP Spam
|
|
|
| Using IIS 5.0, SMTP and CDONTS to generate email.
Reviewing the SMTP log, I see OutboundConnectionResponse entries only.
If someone is using my server as an email relay, what sould I look for in the log?
TIA
| |
| Egbert Nierop \(MVP for IIS\) 2004-05-08, 10:41 am |
| "Bill" <mmm151@nc.rr.com> wrote in message
news:75b4938c.0405061015.10f92d7a@posting.google.com...
> Using IIS 5.0, SMTP and CDONTS to generate email.
> Reviewing the SMTP log, I see OutboundConnectionResponse entries only.
>
> If someone is using my server as an email relay, what sould I look for in
the log?
if the FROM and the TO is both different from your own domain, you surely
have a spammer.
Of course, you need to log the HELO: FROM: and the RCPT TO: verbs for SMTP.
(See IIS SMTP logging settings whether or not you log them)...
But since spammers also fake headers these verbs can be misleading. The most
reliable if the HELO saying host, is not from your IP domain and succeeds to
do a RCPTO and a DATA session with another SMTP server.
> TIA
|
|
|
|
|