Please let others know how useful this tip is via the rating scale at the end of it. Do you have a useful Exchange or Outlook tip, timesaver or workaround to share? Submit it to our tip contest and you could win a prize.
VIEW MEMBER FEEDACK TO THIS TIP
A common and deeply annoying side effect of spam is bogus non-delivery reports (NDRs).
If Exchange Server receives an e-mail sent to a nonexistent address (possibly as part of a dictionary attack strategy), it will attempt to fire off a non-delivery report to the target server.
However, if the target server doesn't even exist -- i.e., if it's a synthetic or randomly generated domain name like xqmngbtrd.com -- the NDR will never reach its intended target.
There's an even further complication: if you receive, say, a thousand spam e-mails from a bogus domain, the consequent NDRs will sit in Exchange Server's outgoing message queue and create DNS lookups for every message.
For bogus domains, DNS lookups will time out. Those excessive DNS lookups will also likely create too much UDP traffic to your DNS server, which will overwhelm other DNS operations and make them time out as well -- including legitimate messages to legitimate domains!
There are three ways to work around this problem:
- Use more sophisticated mail filtering via a third-party appliance or program, so those e-mails don't ever reach your Exchange server in the first place. Obviously, this is the most expensive solution, but if you're already planning to do something like this you can eliminate a whole host of problems at once.
- Create a recipient filtering policy for Microsoft Exchange so recipients that aren't in the directory are filtered out. To do this, open Exchange System Manager (ESM) and select Global Settings -> Delivery Options -> Properties. In the tab for Recipient Filtering, check the box labeled "Filter recipients who are not in the directory."
You will also need to enable the recipient filter on the SMTP virtual server IP address you're using, if you haven't already done so. In ESM, select Servers -> Protocols -> SMTP -> Properties. Click Advanced and select the IP address to modify. Now click Edit, and then check "Apply Recipient Filter." This is a commonly overlooked setting and an extremely powerful one.
- The slowest and messiest -- but probably best first measure if you've got this problem now -- is to stop the SMTP server and manually delete the unwanted NDRs from the queue (usually found in C: \Program Files\Exchsrvr\Mailroot\vsi1\Queue); then restart the SMTP server.
About the author: Serdar Yegulalp is editor of the Windows Power Users Newsletter.
MEMBER FEEDBACK TO THIS TIP
When you turn on recipient filtering's "Filter recipients who are not in the directory," you also need to safeguard against a directory harvest attack once this is enabled. It is imperative to set the tar pit feature introduced prior to Exchange's 2003 SP1 (via hotfix) to any outside facing server. Configure the registry to use the tar pit feature. (Warning: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.)
To enable the tar pit feature, you must add the TarpitTime registry entry to the registry and then configure the delay time value. To do this, follow these steps:
(Note: If the TarpitTime registry entry does not exist, Exchange Server behaves as if the value of this registry entry were set to 0. When the TarpitTime registry entry has a value of 0, there is no delay when the SMTP address verification responses are sent.)
- Click Start -> click Run -> type regedit in the Open box -> click OK.
- Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SMTPSVC\Parameters
- On the Edit menu, point to New, and then click DWORD Value.
- Type TarpitTime as the registry entry name, and then press ENTER.
- On the Edit menu, click Modify.
- Click Decimal.
- In the Value data box, type the number of seconds that you want to delay SMTP address verification responses for each address that does not exist, and then click OK. (For example, type 5, and then click OK. This setting will delay SMTP address verification responses for five seconds.)
- Quit Registry Editor.
- Restart the computer.
—Poomba1
Do you have comments on this tip? Let us know.
Related information from SearchExchange.com:
Learning Guide: Spam
Tip: Dealing with undeliverable messages in Exchange Server
Tip: Stay above the SMTP queue floods
15 tips in 15 minutes: Managing recipients and distribution lists
Reference Center: Exchange Server and DNS tips and resources
Reference Center: Exchange NDR tips and resources
