I would like to be able to check if our mail IP is spamming or not. we are using Microsoft Exchange for mailing. I want to
make sure that we aren't a source of spam to avoid situations that could cause problems with our sending e-mail.
-Kumar Amit.
You will need to look at this from two different perspectives. The first will be to see if someone is using your mail server
from outside of your network to send spam. The other is if a workstation on the network has been infected or otherwise compromised
to where it is sending spam that isn't being generated by one of your users. A wrinkle I recently came across at one company
involved the marketing department using a "mail blasting" program where they were sending out e-mails to a customer list.
A high enough volume in a short period of time can also get you blacklisted. There are ways to handle this, but that would
be the topic of another Help Desk column.
Read the latest WhitePaper - IP Surveillance - The Next Generation Security Camera Application
There is some basic housekeeping that I would suggest that you do before getting started. Make sure that you have the latest
patches/updates for Exchange and the version of Windows that it is running on installed.
This should be done for several reasons - general principle at a minimum, and for best practices to help avoid problems. It
minimizes the chance that someone on the outside can exploit a vulnerability and use you as a sending point for spam.
One step that you can take is to go into Exchange System Manager and look at the outbound queues. A quick look can let you
see if you are a potential source of spam. You can see this by looking at the domain names that are showing a significant
number of messages awaiting delivery. Another thing to look at is the domain names that you are trying to send e-mail to.
If you only do business in the U.S. or just a few states within the U.S. and are sending mail to domains that reside in other
countries or to domains that are in other states where you don't do business, that is a good indication that you could be
a source of spam. You should do this several times an hour when initially starting your investigation, and then once a day
or so on a follow-up basis. Since Exchange System Manager is just a snapshot view of what is going on at any given time, periodic
checks will help you build a baseline to work from. Finding out what is normal for your system when things are working right
will help you more quickly identify problems when things aren't working right.
|
