>>> RSET
<<< 250 2.0.0 Resetting
>>> MAIL FROM: <rlychk@hostX-X-X-X.in-addr.fast-hosts.com>
<<< 250 2.1.0 rlychk@hostX-X-X-X.in-addr.fast-hosts.com....Sender OK
>>> RCPT TO: <"rlytest@rep.rbl.jp">

>>> RSET
<<< 250 2.0.0 Resetting
>>> MAIL FROM: <rlychk@hostX-X-X-X.in-addr.fast-hosts.com>
<<< 250 2.1.0 rlychk@hostX-X-X-X.in-addr.fast-hosts.com....Sender OK
>>> RCPT TO: <"rlytest%rep.rbl.jp">

>>> RSET
<<< 250 2.0.0 Resetting
>>> MAIL FROM: <rlychk@hostX-X-X-X.in-addr.fast-hosts.com>
<<< 250 2.1.0 rlychk@hostX-X-X-X.in-addr.fast-hosts.com....Sender OK
>>> RCPT TO: <rep.rbl.jp!rlytest>

"PeterD" wrote:
>
> Before panic mode, were the emails in question actually sent, or did
> SMTP just 'accept' them? The reason is that MSFT SMTP does accept some
> emails that should be considered as 'bad relay' but then later just
> deletes them without actually relaying them.
>

<BenBlackmore@discussions.microsoft.com> wrote:

>Hi,
>
>We have an SMTP relay setup on our Win 2003 server, which is also running
>ISA 2004 as our corporate firewall. This relays mail to & from our backend
>Exchange 2003 server.
>I thought the SMTP relay was secure as I had configured it according to an
>article on isaserver.org, however after running an open relay test
>(http://www.rbl.jp/svcheck.php) I found that out of the 19 tests, 3 were
>accepted.

> "PeterD" wrote:
>>
>> Before panic mode, were the emails in question actually sent, or did
>> SMTP just 'accept' them? The reason is that MSFT SMTP does accept some
>> emails that should be considered as 'bad relay' but then later just
>> deletes them without actually relaying them.
>>
>
> Hi Peter,
>
> Thanks for the reply.
>
> I'm not sure if they were actually sent or not, I'm using the relay check
> found on http://www.rbl.jp/svcheck.php and the only output it shows is
> that
> in the original post, which doesn't include whether they were sent or not.
> I
> would 'guess' not as the email addresses wouldn't be seen as correctly
> formated containing % or ! instead of an @.
> I'm just double checking that the relay is secure, we have a lot of mails
> in
> our badmail folder, that have been returned by other mail servers to non
> existant users on our domain, when you open the mails the original from
> address is something like uvwxyz@ourdomain.com, I know these are probably
> just emails with spoofed from addresses being returned, but I wanted to
> double check someone hadn't found an exploit in our relay!
> I've used http://www.zoneedit.com/smtp.html which was suggested by Thomas
> Shinder's article
> (http://www.isaserver.org/articles/smtprelayinboundoutbound.html) which is
> what I used to secure the relay. Also checked against
> http://www.aupads.org/test-relay.html and a few othersall say it's secure.
> Only http://www.rbl.jp/svcheck.php reported that 3 tests were accepted.
>
> Ben