I have an SMTP server which has been happily running for a few years now and has not been a problem to look after. But yesterday I discovered hundreds of these errors in the system event log. Error 4000 Message delivery to the remote domain 'sdafire.co.kr' failed for the following reason: The remote server did not respond to a connection attempt. A new error appears every few seconds to a different domain. Is this the result of someone using my server as a relay? If so what tools can I use to monitor the server more closely and stop this from happening? Any advice will be greatly received Thanks.

There is a way to test your server to see if it can be used as a relay. Unfortuately, I only know how to do it using a Unix or Linux box. From an outside unix box you run telnet IP_your_server 25 mail from: neilb911@any_domain_but_yours recpt to: someone@another_domain.com data Type some garbage . That's right, a dot on a line by itself, then quit or control D

chances are yes, you are being used as a relay for spam, mail bombers, etc....