remote domain

On the IIS server, windows 2000 advanced server. I received the following in event viewer:

message delivery to the remote domain xxx.xxx failed for the following reasons. The connection was dropped by the remoted host.

The domain listed is not one of mine. I only have 1 domain. I do have relay turned on, on the iis server to relay email from our website to our exchange server.

Is there a way to track what they are using my web server for?

 

What is the event ID? Did you check your mail logs? c:\winnt\system32\logs there should be a directory labled something like SMTP.

Also, you should turn mail relaying off and only enable the IP address of the exchange server to pass through instead of opening it to the world. Just a suggestion.

 

Event viewer:
Smtpsvc
event id 40000

I only have the ip address of my mail server listed.

 

Sue - it would help to see the exact, entire event log entry. Open it, click on the icon below the up/down arrows, and paste the clipboard contents here.

Also post the results of ipconfig /all > c:\ipconfig.txt from an NT4/2K/XP/etc. system on your domain.

If you are nervous about posting the address information, you can email me the above. But posting it here with xxx masking will make the information pretty well useless.

If you decide to email it, send it directly to me at nvail@ctc.net and put in a link to this thread. I just delete any bbs-mail that is topic related and might not notice that yours was one I asked for.

 

The event log has overwritten it. I do have it saved as a bmp, can I send that to you?

 

Certainly. And include the ipconfig information as well.

Probably be a good idea to use some photo editing app to change tehe .bmp to a .jpg though. Save lots of space normally since the .bmp files tend to be huge for no good reason I've ever understood.

If you don't have an app that will easily change picture formats, get a copy of Irfanview. Does a great job.

 

Well, what do you think of the info I sent?

Thanks for your help.

 

Sue - you sent to my home address and I'm at work now. I'll take a look tomorrow and post the information back here as well as emailing you.

 

Did you get a chance to look at the info I sent you? Also, an fyi, the remote domain is a domain registered to someone in my company.

Any help would be appreciated.

Thanks

Sue