Hi Folks;

I'm running IIS 5.0 on Windows 2000 AdvSrvr and am wondering how I can get
it to stop sending NDR reports. What's happening is that a lot of people
send SPAM to my server (to non-existent addresses) and then the SMTP service
sends an NDR back to them to let them know that the account does not exist.

The problem is that they never use a real address and so it's all just a
waste of traffic. Is there a way to stop IIS's SMTP service from sending
NDR's ?

Thanks!
Dave

[ Post a follow-up to this message ]

> What's happening is that a lot of people
> send SPAM to my server (to non-existent addresses)...

There is little reason for a contemporary MX to accept mail for
non-existent addresses.  Your problem starts there.  What is it that
prevents you from loading a recipient list and using a transport event
sink to reject at the connection level?

The issue of suppressing NDRs -- accepting, then later bit-bucketing,
messages firmly identified as spam -- is different.  That's the "Bouncing
spam is bad netizenship/bouncing spam makes you complicit in Joe Jobs" vs.
"Not bouncing undelivered messages breaks the RFCs/you can never be sure
enough of spamminess" debate.  *That* debate has swung strongly in favor
of the first position for several years.

--Sandy

[ Post a follow-up to this message ]

"Sanford Whiteman" <swhitemanlistens-software@cypressintegrated.com> wrote
in message news:op.tsw7zyv46c17zw@gw02.broadleaf.local... 
>
> There is little reason for a contemporary MX to accept mail for
> non-existent addresses.  Your problem starts there.  What is it that
> prevents you from loading a recipient list and using a transport event
> sink to reject at the connection level?

I didn't know that could be done. Can you elaborate on how this is
accomplished using Exchange 2000 and
a separate SMTP machine as a relay? If I can get the mail server to just
reject all connection attempts to non-existant mailboxes that would be a lot
better :-)

>
> The issue of suppressing NDRs -- accepting, then later bit-bucketing,
> messages firmly identified as spam -- is different.  That's the "Bouncing
> spam is bad netizenship/bouncing spam makes you complicit in Joe Jobs" vs.
> "Not bouncing undelivered messages breaks the RFCs/you can never be sure
> enough of spamminess" debate.  *That* debate has swung strongly in favor
> of the first position for several years.

I don't know much about that - all I know is that my IIS 5 SMTP machine is
kindly sending NDR reports for every email it receives that is not addressed
to an existing mailbox. Of course, the account used to send the mail does
not exist so it's a waste for everyone.

>
> --Sandy
>

[ Post a follow-up to this message ]

> I didn't know that could be done. Can you elaborate on how this is
> accomplished using Exchange 2000 and
> a separate SMTP machine as a relay? If I can get the mail server to just
> reject all connection attempts to non-existant mailboxes that would be a
> lot
> better :-)

5xxSink is a transport event sink specifically designed for the rejection
of
unknown recipients at the MX.

Download:

http://www.imprimia.com/products/so...ownload/release

Be sure to go over the README and RELNOTES in-depth.

> I don't know much about that - all I know is that my IIS 5 SMTP machine
> is
> kindly sending NDR reports for every email it receives that is not
> addressed
> to an existing mailbox. Of course, the account used to send the mail does
> not exist so it's a waste for everyone.

Quite  so.  For you, the waste is abetted by accepting the mail in the
first  place.  *Just*  because  something  was  sent  to a nonexistent
mailbox  doesn't  mean  it  was  spam -- as such user errors occur, in
small  but  non-negligible  quantity,  all  the  time.

Your  server  is  absolutely correct to generate an NDR by default, in
the  absence  of  any spam detection at that level. When the sender is
legit, the NDR is invaluable.

When  the  sender  is  forged  or does not exist, the NDR is extremely
problematic,  one the first hand making you complicit in Joe Jobs, and
on   the   second  resulting  in  postmaster  messages  (double-bounce
notifications).

--Sandy

[ Post a follow-up to this message ]

"Sanford Whiteman" <swhitemanlistens-software@cypressintegrated.com> wrote
in message news:op.tsx98ybz6c17zw@gw02.broadleaf.local... 
>
> 5xxSink is a transport event sink specifically designed for the rejection
> of
> unknown recipients at the MX.
>
> Download:
>
>
http://www.imprimia.com/products/so...ownload/release
>
> Be sure to go over the README and RELNOTES in-depth.

Thanks for the link - it's exactly what I'm after and as you've pointed out
(and educated me in the process) it's the preferred solution :-)

Funny thing - when I copy and paste the following I got an error (due to
syntax)

cscript    smtpreg.vbs   /add   1   oninboundcommand   5xxsink
5xxsink.sink "rcpt"

but when I manually entered the command it worked :-)

> 
does[vbcol=seagreen] 
>
> Quite  so.  For you, the waste is abetted by accepting the mail in the
> first  place.  *Just*  because  something  was  sent  to a nonexistent
> mailbox  doesn't  mean  it  was  spam -- as such user errors occur, in
> small  but  non-negligible  quantity,  all  the  time.

Agreed - although you know more about this then I do :-)

>
> Your  server  is  absolutely correct to generate an NDR by default, in
> the  absence  of  any spam detection at that level. When the sender is
> legit, the NDR is invaluable.

Agreed - it would be a shame to cut that functionality due to spam

>
> When  the  sender  is  forged  or does not exist, the NDR is extremely
> problematic,  one the first hand making you complicit in Joe Jobs, and
> on   the   second  resulting  in  postmaster  messages  (double-bounce
> notifications).

But not anymore..... :-)
Thank you very much Sandy - I appreciate the education and also the better
way to resolve the issue. Much appreciated!

>
> --Sandy

[ Post a follow-up to this message ]

Hi Sandy - I might have spoken too soon :-0

I noticed after installing 5xxxsink no mail was flowing either in or our of
the server. Careful checking showed these errors in the event log;

Event ID 7031
The IIS Admin Service service terminated unexpectedly. It has done this 13
time(s). The following corrective action will be taken in 1 milliseconds:
Run the configured recovery program.

Event ID 7031
The Simple Mail Transport Protocol (SMTP) service terminated unexpectedly.
It has done this 13 time(s). The following corrective action will be taken
in 0 milliseconds: No action.

Event ID 7031
The World Wide Web Publishing Service service terminated unexpectedly. It
has done this 12 time(s). The following corrective action will be taken in 0
milliseconds: No action.

Event ID 2
IIS stop command received from user NT AUTHORITY\SYSTEM. The logged data is
the status code.
For additional information specific to this message please visit the
Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.

Event ID 1
IIS start command received from user NT AUTHORITY\SYSTEM. The logged data is
the status code.
For additional information specific to this message please visit the
Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.

and then they start over again. Un-installing 5xxsink re-enabled mail to
flow again and stopped the error logs from filling up with these messages.

Any ideas on why that would happen? I'm running Windows 2000 AS with all
updates installed.



"Dave Onex" <dave@onex.com> wrote in message
news:uYUm529nHHA.4424@TK2MSFTNGP03.phx.gbl...
>
> "Sanford Whiteman" <swhitemanlistens-software@cypressintegrated.com> wrote
> in message news:op.tsx98ybz6c17zw@gw02.broadleaf.local... 
just[vbcol=seagreen] 
a[vbcol=seagreen] 
rejection[vbcol=seagreen] 
>
http://www.imprimia.com/products/so...ownload/release
 
>
> Thanks for the link - it's exactly what I'm after and as you've pointed
out
> (and educated me in the process) it's the preferred solution :-)
>
> Funny thing - when I copy and paste the following I got an error (due to
> syntax)
>
> cscript    smtpreg.vbs   /add   1   oninboundcommand   5xxsink
>         5xxsink.sink "rcpt"
>
> but when I manually entered the command it worked :-)
> 
machine[vbcol=seagreen] 
> does 
>
> Agreed - although you know more about this then I do :-)
> 
>
> Agreed - it would be a shame to cut that functionality due to spam
> 
>
> But not anymore..... :-)
> Thank you very much Sandy - I appreciate the education and also the better
> way to resolve the issue. Much appreciated!
> 
>
>

[ Post a follow-up to this message ]

> Any ideas on why that would happen? I'm running Windows 2000 AS with all
> updates installed.

Did you make sure you have the two files prescan.txt and rcptlist.txt in
place in the expected location?

I'm not aware of any known issues with the current release.

--Sandy

[ Post a follow-up to this message ]

> Funny thing - when I copy and paste the following I got an error (due to
> syntax)
>
> cscript    smtpreg.vbs   /add   1   oninboundcommand   5xxsink
>         5xxsink.sink "rcpt"
>
> but when I manually entered the command it worked :-)

There are CRLFs in the manual (due to wrapping) which will make the
command unparseable if you cut-and-paste.  

--Sandy

[ Post a follow-up to this message ]

Aha! That was it.I just followed the steps in the readme without really
looking closely at the relnotes file so I missed the requirement for the
prescan.txt file :-)

Thanks for your help with solving this issue - I've tested it a number of
different ways and it's good now and doing exactly what I was after. Have a
great weekend!

Best;
Dave



"Sanford Whiteman" <swhitemanlistens-software@cypressintegrated.com> wrote
in message news:op.tsyg1l0e6c17zw@gw02.broadleaf.local... 
>
> Did you make sure you have the two files prescan.txt and rcptlist.txt in
> place in the expected location?
>
> I'm not aware of any known issues with the current release.
>
> --Sandy

[ Post a follow-up to this message ]

> Thanks for your help with solving this issue - I've tested it a number of
> different ways and it's good now and doing exactly what I was after.

Excellent.  Enjoy.

--Sandy

[ Post a follow-up to this message ]