Email Sent from my Domain for Non-Existent Email Addresses

Question asked by Cliff Hammock - 12/21/2015 at 2:41 PM

Answered

I started getting a lot of "delivery delayed" emails like the one below.

The server(s) that the message "RE:" is attempting to be sent to has temporarily delayed the delivery for the following recipient(s):

identities@sbcgloal.net

There will be up to 12 more delivery attempt(s) of this message. Do not re-send your message until there are no more delivery attempt(s) and the messages bounces back to you.

But it shows the email is from streetjeff@theforerunnernetwork.com and this is not a valid email address on my SM installation. The domain is correct, but there isn't an account for that user. I currently only operate my mail server for my own business emails. I looked in my spool and there are hundreds of outgoing emails from addresses that don't exist on my server. I have tried to keep my SM install security updated based on the security settings recommended here, but something must not be right. I ran some diagnostics and it says rDNS is OK and it is not an open relay.

I don't really have a good idea what the problem might be? But obviously this is a pretty bad thing that I need to resolve quickly.

4 Replies

Reply to Thread

Employee Replied

12/21/2015 at 6:35 PM

Employee Post Marked As Answer

Hi Cliff. Without viewing your logging details, I can't verify what's happening. But to help, please check the following:

https://portal.smartertools.com/kb/a2873/find-a-compromised-account.aspx

Also, in Settings >> Protocol Settings >> SMTP In tab, adjust your settings to these:

Allow Relay: Nobody

This will force all relay attempts through your SmarterMail server to authenticate first.

Require Auth Match: Email Address.

This will require that the authenticated address matches the 'from to' address in the email.

For safe measure, I would bounce the SmarterMail service also.

If you're still experiencing an issue afterwards, please submit a support ticket and we'll look into this for you.

Cliff Hammock Replied

12/22/2015 at 9:44 AM

Thanks Rod. I had the Relay setup correctly. I changed the Require Auth Match to Email Address and no more problems. I deleted all the items in the SPOOL and no others have shown up. I don't see anything about that particular setting in the ST Online Help system, so I am not sure exactly what it does. But it did solve my problem and I really appreciate your guidance.

Dzung Huynh Replied

10/31/2016 at 8:49 AM

"For safe measure, I would bounce the SmarterMail service also."

Where do you actually do this step?

Employee Replied

10/31/2016 at 1:51 PM

Employee Post

Dzung, this is done within the Windows Services console. You can access this by accessing Start -> Run, enter services.msc and hit OK. Then locate the SmarterMail service, and issue a stop. Wait for mailservice.exe to terminate completely before starting it back up.

I hope this helps.

Back to Community Threads

Please leave this box unchecked

Reply to Thread

Enter the verification text