I would like to be able to check if our mail IP is spamming or not. we are using Microsoft Exchange for mailing. I want to make sure that we aren’t a source of spam to avoid situations that could cause problems with our sending e-mail.
I would like to be able to check if our mail IP is spamming or not. we are using Microsoft Exchange for mailing. I want to make sure that we aren’t a source of spam to avoid situations that could cause problems with our sending e-mail.
-Kumar Amit.
You will need to look at this from two different perspectives. The first will be to see if someone is using your mail server from outside of your network to send spam. The other is if a workstation on the network has been infected or otherwise compromised to where it is sending spam that isn’t being generated by one of your users. A wrinkle I recently came across at one company involved the marketing department using a “mail blasting” program where they were sending out e-mails to a customer list. A high enough volume in a short period of time can also get you blacklisted. There are ways to handle this, but that would be the topic of another Help Desk column.
There is some basic housekeeping that I would suggest that you do before getting started. Make sure that you have the latest patches/updates for Exchange and the version of Windows that it is running on installed.
This should be done for several reasons – general principle at a minimum, and for best practices to help avoid problems. It minimizes the chance that someone on the outside can exploit a vulnerability and use you as a sending point for spam.
One step that you can take is to go into Exchange System Manager and look at the outbound queues. A quick look can let you see if you are a potential source of spam. You can see this by looking at the domain names that are showing a significant number of messages awaiting delivery. Another thing to look at is the domain names that you are trying to send e-mail to. If you only do business in the U.S. or just a few states within the U.S. and are sending mail to domains that reside in other countries or to domains that are in other states where you don’t do business, that is a good indication that you could be a source of spam. You should do this several times an hour when initially starting your investigation, and then once a day or so on a follow-up basis. Since Exchange System Manager is just a snapshot view of what is going on at any given time, periodic checks will help you build a baseline to work from. Finding out what is normal for your system when things are working right will help you more quickly identify problems when things aren’t working right.
Another source of information would be the spam database lookup sites that are available on the Internet. Using Google will give you a good starting point to work from. Several of my favorites in the past are no longer available or have become pay or subscription sites.
What I have outlined here is not a one time process, but one that will need to be reviewed on a periodic basis. Sometimes by applying a patch or changing one configuration selection could cause spam to be allowed to go through your server unchallenged. It shouldn’t happen, but it can and that is what you need to be prepared for.
