Last year I wrote an article about how spam could not originate from inside your network and go through your Exchange server, because that was simply too much hard work.
You can read the original article here: http://blog.sembee.co.uk/archive/2008/03/13/73.aspx
As a brief summary, I basically said that a spammer needs to get their BOT inside the network, find the Outlook installation and then abuse it, or they could take the simple route of having their own SMTP engine and send email directly.
Remember a spammer doesn't want to be found, and sending a large amount of messages through Exchange will alert network administrators that something is wrong.
Alas despite that posting some people continue to believe that someone who is being flooded with spam in their queues will have a compromised client, despite the changes being very slim.
The purpose of this posting is to help you diagnose whether the message has come from a client inside your network, or not.
Do that, you need the SMTP headers of one of the messages.
Background
First a little bit of background about Exchange and SMTP headers.
When you send a message from a MAPI client (so that is Outlook, Outlook Web Access, a Windows Mobile device using Exchange ActiveSync or a Blackberry using a BES) then the SMTP headers are not actually put on to the message by the client, but by Exchange when the message hits the SMTP server. That is why you do not see any headers on internal email messages or show the internal IP address of the machine that originated the message on external email messages.
If you send the message via an SMTP client (Outlook Express etc, a PDA with IMAP/POP3 access etc), the SMTP header is generated by the application originating the message.
If you bounce the message off Exchange's SMTP virtual server (relaying) then the header stays intact and Exchange simply treats it like any other SMTP message that is passing through.
It is the originating application line that will show you whether the message has come from inside.
Getting the Headers
If the server has already been blacklisted, then on many of the blacklists you can see the message that was received, which will show the complete headers.
If you have a large number of messages in the queues, then you simply need to get hold of one of those messages. You will find them in \exchsrvr\mail root\vs 1\queue.
Drop one on to a notepad document, which should open for you.
What you are looking for.
When you can see the raw header, you are looking for something like the below.
If the message originated outside of Exchange, then look for something along the lines of these examples:
- X-Mailer: Microsoft Outlook Express 6.00.2600.0000
- X-Mailer: The Bat! (3.0.2.8) Professional
- User-Agent: Thunderbird 2.0.0.19 (Macintosh/20081209)
If the message originated on Exchange, then you will see something similar to these:
- Exchange 2000:
X-MimeOLE: Produced By Microsoft Exchange V6.0.6619.12
- Exchange 2003:
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.3790.4325
X-MimeOLE: Produced By Microsoft Exchange V6.5
- Exchange 2007:
Received: from host.domain.local ([fe80:xxx:xxxx:xxxx:xxxx]) by host.domain.local ([fe80:xxxx:xxxx:xxxx:xxxx]) with mapi;
Received: from host.domain.local ([123.123.123.123]) by host.domain.local ([123.123.123.123]) with mapi;
Of course the headers are not completely fail safe. Antivirus and anti spam applications can strip content off the headers, as can other third party tools that will scan SMTP traffic. However the presence of non-Microsoft products in the headers is a clear sign that the message originated outside of your network.
