Resume outgoing mail after spam sent from your server

[--VQ--]

Question:
My mail server was blocked from sending through vqNow after Spam was relayed from here. How can I resume sending?

Answer:
You can send immediately, by routing outboing mail directly onto the internet rather than relaying through the vqNow security server. To do this, remove the relay setting on your mail server (on Exchange, reset the Smart Host or SMTP Connector)...But we don't recommend that you do this until you have located the virus or security breech that caused your server to issue spam in the first place!

Here are the steps to fix the problem at your end and to remove your outgoing email restrictions:

1. First, block the IP address from which the spammer is gaining access to your mail server. To determine the IP address, inspect the headers of a few spam emails within your own server. This will also tell you if the spammer is authenticating as a user or if he is just relaying through your server.

2. Next, determine how the spam is entering your server so that your response is appropriate to the breech. That means that you must either detect the virus that is sending from within your organization (check every PC and the mail server) -or- determine the user password that is being used by an outside spammer to authenticate.

Note: If you are not requiring individual user authentication, then you are operating an open relay. This may be the source of your problem.

3. Next, cut off the spammer by responding with the action that is appropriate. You must either:

• Shut down your open relay - if you have one
  
• Remove the virus (and running AV and Antispyware on all PCs and servers)
  
• Change the user password that has leaked

4. Finally, you must contact Vanquish to resume your trusted IP relay. For this, you must complete steps 1,2,3. We cannot resume outgoing mail privileges until you are certain that the virus or leaked password has been removed from your entire network.

Use this form to request the restoration of your sending privileges. Remind our technician to re-enable 3 things. (Depending upon the severity of your situation, we may have blocked one or more of these things:

• Remove SMORF block
  
• Re-authorize trusted IP relay
  
• Check for IP range exclusion