Then relaying for addresses won't work, if they are spoofing your addresses.
In your log, can you see any highly recurrent, repeating "from:" values
that you could filter against ?
Len
=======
>That is exactly what they are doing. Faking the IP address so it looks like
>it is sending internally.
>
>Although when you say:
>
>the way we solved it was by putting in each ip and or subnet as we went
>along.. much more tedious..
>
>Could you be more specific?
>
>
>Thanks for the quick response!!!
>
>-----Original Message-----
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED]]On Behalf Of Simon
>Sent: Tuesday, February 22, 2000 6:30 PM
>To: [EMAIL PROTECTED]
>Subject: RE: [IMail Forum] I am getting killed by spammers relaying on
>my servers.
>
>
>we had that very same problem.. it seemed that messages were only able
>to be sent to our internal network & virtual hosts, but from one of the
>spam 'authorities' we were sent an example of how the 'spammers' managed
>to get by, the first two attempts at using our mailserver as a relay were
>denied, then the 3rd time, it faked our IP so that it looked like it was
>coming thru our internal network - this was using imail 5.08 or something.
>the way we solved it was by putting in each ip and or subnet as we went
>along.. much more tedious.. with what shuld have been the same result using
>relay mail for local hosts only.
>
>simon
>
> > -----Original Message-----
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED]]On Behalf Of Scott Bishop
> > Sent: Wednesday, 23 February 2000 10:54
> > To: [EMAIL PROTECTED]
> > Subject: [IMail Forum] I am getting killed by spammers relaying on my
> > servers.
> >
> >
> > I have several options selected
> >
> >
> > smtp security
> > relay mail for internal addresses only (on my network)
> > allow remote mail to local groups is checked.
> > check valid sender is checked
> > aut deny possible hack attempts is checked.
> > disable smtp vrfy command is checked.
> >
> > people are still able to relay mail from my server without authenticating.
> > Im about 1 day away from my UPPER ISP providor filtering mail to
> > my servers
> > cause I cant stop the spam! I have even denied access to the offenders
> > causing the spam, and emailed the proper authorites. But new spam servers
> > pop up everyday relaying through my secured smtp server (secured hah)
> >
> >
> > Ive been at this for 5 days. Can I get any suggestions??
> >
> >
> >
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
>
>Please visit http://www.ipswitch.com/support/mailing-lists.html
>to be removed from this list.
>
>Please visit http://www.ipswitch.com/support/mailing-lists.html
>to be removed from this list.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
