Have you tried opening some of the message files in \exchsrvr\imcdata\out with a text editor to see what they all are? I would think the <> messages would just be the usual NDRs, but anything showing an AOL address as the originator would definitely be unnerving, and might point to a spammer who can authenticate.
As it happens, I have our routing restrictions set up the same as you with both specific ip addresses, and users who authenticate checked, and haven't noticed any excessive and unaccountable activity in the out queue. -Peter > ---------- > From: RGrant > Reply To: Exchange Discussions > Sent: Monday, September 29, 2003 6:22 AM > To: Exchange Discussions > Subject: IMC out bound queue question > > I have read about other folks having troubles with thier outbound queue > getting hammered, and mine is not exception. My question about this > involved the IMC properties tab called Rounting and then under that, the > routing restrictions. I have noticed that when I have " hosts and clients > that successfully auth" box checked, my queue gets hammered with tons of > junk. Some with originators with adress like [EMAIL PROTECTED], and the anti loop > <>. some of these <> are in the thousands from yahoo.com and aol.com etc. Now, > when I take that check mark off, leaving only "hosts and clients with > these IP address'" my queue totally calms down and my processor stops > pegging at 100%. Why would this change make that difference? Am I allowing > the spam through for some reason with that check box unchecked so it > doesnt pile up in the queue? By taking off the > " hosts and clients that successfully auth" , am I denying an internal > user who might have a mass mailer access to the outbound queue? To me it > would still hit the queue, just return to them a 550. > Any thoughts on this would be great! My environment is Windows 2000 > server, with 5.5. No AD, and current Service packs. > Thanks, > Ron > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > ______________________________________________ This message is private or privileged. If you are not the person for whom this message is intended, please delete it and notify me immediately, and please do not copy or send this message to anyone else. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
