Many Exchange 2000 administrators are attracted to Exchange 2003, in part because of its broad array of antispam features, such as intelligent message filtering, support for blacklists and reverse Domain Name System (DNS).
Reverse DNS is fairly effective against unwanted e-mail since a great deal of unwanted e-mail can be blocked by performing a reverse DNS lookup against the sender. A reverse DNS lookup also requires very little in the way of server or network resources.
Unfortunately, not everyone can upgrade to Exchange 2003 just yet, whether the reason is budgetary constraints or time constraints.
The good news is that in the interim, you can configure Exchange 2000 to perform reverse DNS lookup on all incoming mail.
What you need to do involves exploiting a little-documented feature concerning how Exchange can be set to accept mail from all but a certain domain. Here is what you need to do:
1. Open the default SMTP Virtual Server's Properties page.
2. Under the Access tab, select Connection.
3. Selection the "All but the list below" option to screen incoming mail.
4. Add a domain that you know to be completely nonexistent (i.e., bogusdomain would work fine).
5. Click OK
Setting this function forces Exchange 2000 to perform a reverse DNS lookup with each new SMTP connection it creates. If the incoming SMTP connection fails by dint of not having a valid DNS record, the connection will be dropped and the message never delivered. This not only cuts down on the amount of unsolicited mail delivered in the first place, but also limits the number of bogus SMTP conversations with your Exchange Server.
Many people may ask, "What happens if a valid e-mail is re-mailed with different headers?"
In some cases, this mail would bounce. The best way to handle this situation is to have the e-mail forwarded as an attachment rather than re-mailed. I've talked to other experts about this and they agree that it's a small price to pay for that much more mail security. However, if you are in a situation where you are getting a lot of redirected/re-mailed messages as part of the function of the Exchange server (for instance, if you're getting redirects from a mailbox designated for you on another server), then that may be a problem. In this case I would talk to the admins on the other server and see if the mail can be held there for POP3 pickup rather than simply re-mailed, and set up a POP3 account on the target user's mail program.
If you are being hit with an abundant number of spams from servers that fail DNS lookup, this will help free up the incoming bandwidth those servers are eating up.
Serdar Yegulalp is the editor of the Windows 2000 Power Users Newsletter.
Do you have a useful Exchange tip to share? Submit it to our monthly tip contest and you could win a prize and a spot in our Hall of Fame.
