SPAM with error 551 This mail server requires authentication before sending mail from a locally hosted domain.

[rgvwebmaster]

I've looked around but can't find anything specifically addressing my question.

Is it possible in MailEnable to either stop creating or to redirect messages created with a "551 This mail server requires authentication before sending mail from a locally hosted domain" error message? Some of our users are being bombarded with these error messages caused by someone trying to spoof their email address to send SPAM. The message is annoying and of no value to the end user but could potentially be of some use to me as a mail admin.

The most ideal solution would be a way to redirect that specific error message to another mailbox, where I could reference it if it was actually useful in diagnosing a real sender problem, but could be otherwise ignored.

If redirect isn't possible, then having a way to turn off that *specific* error message, without turning off other important 551 error messages, would at least solve the problem of end users being bombarded with error messages for emails they didn't send.

Any ideas?

[Admin]

The error message is used in the SMTP conversation, no email is sent containing this, but bounce messages generated by the sending server may do so. So if it is a bounce email, it could be generated by either your server, or a remote server. You'd need to check where the emails came from in order to see what options you have to block the bounces.

[rgvwebmaster]

The error message "claims" to be coming from our MailEnable server and the claim appears to be correct. I think it is being generated by the spoofed email address attempting to send to itself and failing because it is not authenticating on our server. That generates the 551 error about authenticating before sending.

I want to either delete or (preferably) divert *any* 551 authenticate before sending error message so that it never reaches my users Inbox.

[Admin]

Seems as though the email is generated on another server that is using a from address on a domain on your server. Possibly SPF may help, or you can make a filter to remove them. In order to be generated on the MailEnable server you would need to relay through your server to another MailEnable server using a domain on the destination server. Which is unlikely.

[rgvwebmaster]

Perhaps I wasn't clear enough. I know the emails that trigger the error messages aren't being created on our server. As I noted in the OP, these error messages are being generated on our MailEnable server because someone is trying to send spoofed email messages through our server using an email address that is valid on our server and the server is rejecting the email because it is not authenticating, as indicated in the error message I copied in the OP -

"551 This mail server requires authentication before sending mail from a locally hosted domain"

I don't know of any way to block the original spoofed email message because we don't know it is spoofed until the login fails, at which point our MailEnable server generates the error message.

What I need, as I indicated in the OP, is a way to block that *specific* error message from being created.

[rfwilliams777]

Go to Servers-->Localhost-->Services and Connectors-->SMTP (go to Properties). On Security (these are my recommended settings) tab, check boxes 1, 2, (do not check sub box), and 4 (disable catchalls). Also check connection dropping and set the number to 15. Click on button for Address spoofing and set it to the middle option. Click on Advanced SMTP and check Header Fixing and set Inbound Authentication to "do not require authentication". Apply and ok the settings. You can restart the service but I recommend that you reboot the server. See if that helps.

[rgvwebmaster]

Thanks. I appreciate the suggestions but unfortunately, I already have all of those settings (except 15 for connection dropping - mine is set to 20) but that doesn't fix the problem.

I fear the problem may be more fine grained than the MailEnable server is set to deal with. I need to restrict delivery of only a subset of the 551 error messages, the 551s that inform the perceived sender that they need to authenticate before sending.

I thought I could do this with the Failure Notifications setting but I have that set only to "Only generate NDRs for senders who authenticate" and the server still generates the 551s for senders who fail to authenticate.

What I need is a way to turn off that specific 551 notification or else redirect it to a different email address, so I can sink hole the messages before they get to my end users.

[rfwilliams777]

Have you tried to set up a rule that if the message body or subject (or sender) contains certain text that it redirects/deletes/moves/copies the emails?

[rgvwebmaster]

I've considered that, but it seems like a lot of overhead for email processing to sort through every incoming email.

Beyond that, I'm not certain that would make any difference since the problem is error message emails being generated on my MailEnable server, not incoming messages that contain an error message. The incoming message itself never reaches the server because it is rejected for lack of authentication.

As I explained in an earlier post, I can't filter the incoming messages for two reasons,
1) because there is nothing to identify them as unauthorized until they reach the SMTP server and are rejected because they don't properly login, so there is no incoming message to filter, and
2) the server generates the error message and sends it to the internal address that the email claims to be coming from. Any filtering would have to be of the server generated error message, before it is delivered to the recipient email box.