ME020280 - INF: How to determine whether spammers are relaying through the server?


SUMMARY

The MailEnable SMTP Debug log provides a report of relay access attempts to the SMTP server. Using the entries within this log, it is possible to pin-point and relay attempts and their status.  To search the logs, a Log Analyzer utility is contained in the MailEnable program group, this will display all failed connections in a concise manner for review.

 

DETAIL

Listed below are some entries that may appear within the SMTP debug log and what they mean:

ME-I0111: Relay Denied: Failed to meet all relay criteria.
>> Someone attempted to relay through the server but they were denied because they either were not authenticated, were not from an allowed IP or were not identified as a local sender address.

ME-E0109: Relay Denied: Failed to meet all relay criteria.
>> Someone attempted to relay through the server but they were denied because they did not use a sender address that is defined on the server

ME-I0112: Relay Denied: Server is configured not to allow relaying
>>All relay settings have been disabled for the server

ME-I0110: Relay Granted: Server is configured to allow anyone to relay.
>> Server is configured to allow anyone to relay

ME-I0108: Relay Granted: Sender has authenticated.
>> The sender entered a valid user name and password before sending mail and was therefore allowed to relay

ME-I0106: Relay Granted: [address] is in local address map.
>> The server has been configured to allow locally defined addresses to relay and the sender used such an address. For public servers this is not good, as someone only needs to guess a mail address serviced by the server and they can spam

ME-I0107: Relay Granted: Sender IP (IPAddress) is within an authorized IP range.
>> The relay attempt was allowed because the remote IP Address has been granted relay access under the SMTP Connectors properties.

ME-I0102: Address ([SMTP:xxx@yourdomain]) is to be delivered to Catch-All address.
>> Someone (most likely a spammer) sent a message to an e-mail address that is not defined on the server. The domain is local and was configured with a catch-all mailbox and the message as therefore accepted and distributed to this mailbox.

ME-I0101: Local Delivery: Address (%s) is local.
>> The recipient address specified by the sender is local and therefore no relay authorization is necessary.
 



Product:MailEnable (Custom: Custom: Custom: Custom: Custom: Custom: Custom: All Versions)
Module:SMTP
Keywords:SMTP Debug log spammers entries MEspamming spam abuse server
Class:INF: Product Information
Revised:Wednesday, May 4, 2016
Author:
Publisher:MailEnable