询问者
Exchange2013队列全部都是垃圾邮件,几百个队列,望大神帮助,谢谢!

问题
-
环境:
1、2台Exchange 2013 CAS前端,没有做NLB,25及443端口映射CAS1。
2、2台MAILBOX 2013 后端,有1台开启了匿名接收,接收范围来自服务器的IP整个网段,由于SMG防垃圾邮件网关也在这个网段里面
3、SMG防垃圾邮件网关1台,投递到2台mailbox后端上。
4、邮件发送直接通过MX记录发送。(没有做通过SMG来发送)
问题:
1、Exchange2013后端服务器上队列每天100-200个,都是垃圾邮件,发件人为空,如下图。
2、禁用发件人为空的邮件及启用收件人过滤器 都是启用着的。
Set-SenderFilterConfig -BlankSenderBlockingEnabled $true
Set-RecipientFilterConfig –RecipientValidationEnabled:$true
3、通过命令导出了一封发件人为空的邮件的邮件头如下:
X-sender: <>
X-Receiver: <xoxfrx@zrrk.com>; X-ExtendedProps=BQAmAAIAAQUAIgAPADEAAABBdXRvUmVzcG9uc2VTdXBwcmVzczogMA0KVHJhbnNtaXRIaXN0b3J5OiBGYWxzZQ0KBQAjAAIAAQ==
X-CreatedBy: MSExchange15
X-ExtendedProps: BQBJAAIAAQUAZAAPAAMAAABIdWIFAAQAFCABAAAADwAAAHhveGZyeEB6cnJrLmNvbQUABgACAAEFACkAAgABBQBiAAoAOAAAAEoAAAAFAAIABwABAAAABQADAAcAAAAAAA8ACQAAAENJQXVkaXRlZAIAAQUABQACAAEPADwAAABNaWNyb3NvZnQuRXhjaGFuZ2UuVHJhbnNwb3J0Lk1haWxSZWNpcGllbnQuT3JnYW5pemF0aW9uU2NvcGURAAAAAAAAAAAAAAAAAAAAAAA=
X-Source: DSN
X-SourceIPAddress: 255.255.255.255
X-EndOfInjectedXHeaders: 15579
MIME-Version: 1.0
From: <postmaster@xxx.COM>
To: <xoxfrx@zrrk.com>
Date: Mon, 26 Oct 2020 01:40:01 +0800
Content-Type: multipart/report; report-type=delivery-status;
boundary="a728514e-0dc5-40bc-8d9f-4471bac4eda1"
X-MS-Exchange-Organization-OriginalArrivalTime: 25 Oct 2020 17:40:01.8659
(UTC)
X-MS-Exchange-Organization-SCL: -1
X-MS-Exchange-Message-Is-Ndr:
X-MS-Exchange-Organization-Dsn-Version: 12
Content-Language: zh-CN
Message-ID: <3e6b99bf-05f4-44bf-ba9a-9969130ec61e@MAILBOX04.xxx.COM>
In-Reply-To: <46.83.29012.520C59F5@smg.xxx.com>
References: <46.83.29012.520C59F5@smg.xxx.com>
Subject: =?gb2312?B?zrTLzbTvOiDTxbvdtPq/qreixrGjqNHpuvO4tr/uo6nOotDFusUgZ2d5dTg3?=
=?gb2312?B?MSDXydGv?=
Auto-Submitted: auto-replied
X-MS-Exchange-Organization-Transport-Properties: DeliveryPriority=Normal
X-MS-Exchange-Organization-Prioritization: 1
X-MS-Exchange-Organization-Spam-Filter-Enumerated-Risk: Normal
X-MS-Exchange-Organization-AuthSource: MAILBOX04.xxx.COM
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 05
X-MS-Exchange-Organization-Network-Message-Id: 7b2cf358-cb6e-46e4-0f9e-08d8790d0040
X-MS-Exchange-Organization-HygienePolicy: Standard
X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0
X-MS-Exchange-Organization-OriginalSize: 11165
X-MS-Exchange-Organization-Recipient-Limit-Verified: True
X-MS-Exchange-Forest-IndexAgent-0: AAE1CQAADwAAAx+LCAAAAAAABAClVutTE1kWv3mSBOLMjlNbs9+6rL
JGxu2YbtJJCDKIiLOsMCgwszpTU1aTB7YDCSYdNfMpICqovEZEURRf
jOyWAq4gDAH8Y+zbST75L+y53QnpQEbdXaordbj3PH7nd8499z79s9
2Gx8al1Ky0el2eeC2lXktra/LgZDo1IK0/zCZ/zfbPwyJ++jKzNOuz
2y7w4a6z8fChmNDLCw5/pMduk4c2pdVhPLgo989lNm/iy7PpuwPpiW
X8YixnPL2I7yffJvszCyvyk6Q8M7sVqaQm/v01XryfWbiVvTosTy7i
0fFssk9VACf4t375wXT29nz28R0pNZweeI1f3MHTc+/Wb4B/aXVEnl
iQb/SBczx+J9M3kX6VAiu7Tdq8l55/lB67AsvSxpv0xBwEzyxckydf
SG8eyX0LkF16YkYeHJOnh/G1R3hqzke11Dc1H2496XQ52puO1zc5Gl
pbSnLQFuyJiEGqPRg9H4xS0aAYj4aDAepLjnNSnINxMFRbY3tr8/eN
bY76I22OtqBf6P02Ih6NxMOBGiocEakQEb+EaozM4GfX86wv+Yhvf1
A4Hwz4qFA00rMFiSlAovYxVayDYZ0OpqrKwXKVVGeiNPScIgByuCqp
C4J4hmoR/NFILBISqfaWjuP5FPZ1NLdXUkKAYjgHuHVVexxsDdUSCf
+VYt1Uq1+021gn66ScjM/l9DkZar/T63TuABvr6XJs0bQNZnURTKYE
zEI+70FajJE6L/DU0WgkLAbDAbutI8qHY72RqFiEnSoJ/SRdHw8IYt
MRH+V1ebxejgnQIU8153cHnOTPw3Au2ltNcyFYc7Kcm2M4YtUUPs93
CwFaKaoQDIuxnUX7JRr9WaXgu/DP4ciF8OkjkR5eCFM/MkyVw+OBRN
0Oxsv8VGm3ASnbaGtP9PCQkJ9qCcZifJcQ7qK+4cXgBT6RY0bhA4hw
uR1ewqyTYR0c62zgqo9ypTJnfQzr46rUzKl9fzvWUbkD8vEGmnUynJ
MBhvb9yLAe4BhY/kmpWnfEz3eficREhe+OhuMqjkYCpL401xzn47x5
rtVEgjQh+2Ap1IeKKPjabjsiQB1jgihEwjScHCEk+Hnln46IjwL2vN
Vut5txHTp3Tj2RLU0tjfT3wWgMdEDBAUGhLXp8VG1dXAzR3roTdbWN
3trDHPkaXbWHG2qrj9bVUgd3+ILg7dBMweiHbS9GLoaiFw/lqw2WBN
3BHQPja8J2b3dCAf+/ADoC5fd9mOb2eOfZoF8sxDhcxzUnTnGR1i6u
OX6W60zUc6f2t3Huf0Q8nkSTmz/Xwv3Q0Ap7p7hzif2w9neu0x3nmv
efAb2qpm8C4eDJ71zf/tLYxf1wLOI+tl+oq7XbGpTjJtIdiV5A1RPv
FiHRqHiA7xaD0TCU6XywBvqaTDg+mqjdQ9N5+bS7imVZ12ku5K3qrG
ZCdDUbDNAuV7Wb5kNOnnbynXxngHV2VgU69xDSyGClj/PiGR+1jWy7
jQJO4ajD8aBbOup9VCAcqyk5BfOdTpOOKOgWtZzdVh+NCnCyaZXr9j
jhmitwzXi2xoeTcA39JYRBfWsM+KhoyO9l2ZoS90W9X1T6MsQL3UGY
U+0iL8ZjPvWuIM3Od4XhdAl+uiESgOixHrG35r+8TAgkCu699TvypY
dS6gleT8JVmp6Fm3Iw+68beGxESt2Rn2++Wx/Cm/NwB+LRFaqrKxH3
ehgK/zqXWXhst4GulFqRH65LqRHwBLryyGxmeUCenJJW78I1eeJEoT
/ttszVpczSMh6+JW0My8lU5knfgczSY1A7kE6Nwt17QFq/m5l/RP1x
wOylcXLtD73JLKy9TY5Jq2vpR6B7X55+ji8/x6Or8lCSZHJ1DZI5AN
mQJ8T0DJ5/ICefwRsge2kDXx5Mp6ZgC7LMLPRBovjKsJrr2+Q4PFgG
x8EPPBnw5Tl8bwMeFBAI37gtrT1/m+yTVq/Jyysg4HngZYMINwfx4o
ScmiPycE5NXp6SX86Qlaf/lJdmQQDYeO0KES6N45UHIGSuj6oCHvkt
e5uYyysv8fQronPrjfzvKcXPCPgkOvfu4ZX7ADD9YgiPDeCnz/DMCF
7tz8xvytNDePBKLv3BSXztgbR2HT8dIK+h0fGvvoJU8f2rQBWxU7iH
5NJzI+QV8zKZnniVfXwFqMGjC+mNcZLfzCxwTTwNLhK1l0mVKfnasj
z0BDThfYZHJ2Er3f87HhuEwkmrE9mrowBK7QOIrHaUVjNz4xK+twR0
wlvy3fpdpXkY6BjGvVf1jB8/wMl1UJZWb8L7K1fAfa69tGdvpaJeRR
psaj6bvAuFIaRME4DwL6jL02vy0M28EbOXZnNGLtLBedc5621a1P9z
Ciik1yGdHukNyACCKiufqUyH/oQsJmQ2IJO6taWgUTNozfOLWgWio5
W3RdE6zK+b8k4MVh3ajWwqBi0eMyqDz6KzGRB4NOoQONUXfpHeokMV
yGpARjv6BH5NyJL3abQgmxGZtJ4B0y5kNCifnnzauGbYLVe2dAokYq
t4MCML2Op1kB1sGNToRgR6JgWDwaAzkS1FUNctCAFmIiOzCgPM7ATe
R8HQ7mpglP0xBqgLydeKyjVgjDvBgGYZslqQ9VPdpwqlikOkL0d2Zc
tiQ3YVMLBgAahKOXYhCyFBAUY8E2xlSohCUuATcIJzYquhS/01IWRS
qHg/PEOeLr1Ob0XIiioghDVXEVJTwhU4UcjJlea9DstIP4A3tIc0p0
HBYDXkMJvLUUUFsgPJNtJy5UpqBHyZzkrIIbIlTxEAMei3f2aNodlM
snufMrD/CSojzYDMxefObCIr5o+PRbj6QOLlGm/6z9DuL9BfbLCIjL
vR5zqIjiygBmSWo10WVAHn6Aud1YyQctwsSvoGqIJaOKPOmO+TXWaS
QlEuSkVAMGrPmkXpBHVd2ydq3PeCJ5xAJ0Og4lFAmtCss+wYAgbIy0
hAmj56SlSQEQEbuRm1NazU4WbItY1m7sFXgXZpZlqhNBoTo9Zk67c4
hNrJ28esIijjt4CKaG5FUabBzq4wbEOyzac6rpWZZtgZNP9bwrD4X7
0GpF6zayhGmydHZ1bJV7toC0kud51emQnKrq5MLVA+WX0BUim10k7I
LPpQNf8DKjpGCCUSAAABDQV6aC1jbgEOzwFSZXRyaWV2ZXJPcGVyYX
RvciwxMCwwO1JldHJpZXZlck9wZXJhdG9yLDExLDM7UG9zdERvY1Bh
cnNlck9wZXJhdG9yLDEwLDM7UG9zdERvY1BhcnNlck9wZXJhdG9yLD
ExLDA7UG9zdFdvcmRCcmVha2VyRGlhZ25vc3RpY09wZXJhdG9yLDEw
LDEwO1Bvc3RXb3JkQnJlYWtlckRpYWdub3N0aWNPcGVyYXRvciwxMS
wwO1RyYW5zcG9ydFdyaXRlclByb2R1Y2VyLDIwLDY=
X-MS-Exchange-Forest-IndexAgent: 1 2582
X-MS-Exchange-Forest-EmailMessageHash: 4BF00276,F0EF6A5F,7F8C1A3E
X-MS-Exchange-Forest-Language: zh-cn
X-MS-Exchange-Organization-Processed-By-Journaling: Journal Agent
X-MS-Exchange-Organization-MessageHighPrecisionLatencyInProgress:
LSRV=MAILBOX04.xxx.COM:TOTAL-HUB=43200.000|UTH=0.005|RST=43200.000|QS=0.001|CATSM-RMS
Decryption Agent=0.241|CATSM-Malware Agent=0.997| CATSM-Text Messaging
Routing Agent=0.002|CATSM-RMS Encryption Agent=0.007|CATSM-Journal
Agent=0.587| CATSM=1.862|CRSL=0.582|CAT=2.612;2020-10-26T09:11:10.334Z
求教各位大神,有什么根治的解决办法啊,这问题困扰了2个月了。。。
- 已编辑 甜蜜的诱惑 2020年10月27日 8:16
全部回复
-
您好,
从您提供的邮件头来看,这个邮件是从您方服务器在拒收垃圾邮件时,自动生成的未送达邮件(NDR)。由于这些垃圾邮件的原始发件地址多是无效的伪造地址,这就造成这些NDR无法发送出去,于是卡在了队列中:
针对目前的情况,对于已经在队列里的这些邮件,您可以手动直接删除。
此外,为了避免后期继续生成这些NDR,建议您考虑禁用对远程域发送NDR:
set-RemoteDomain "Default" -NdrEnabled $false
此致,
Yuki Sun
如果以上回复对您有所帮助,建议您将其“标记为答复”. 如果您对我们的论坛支持有任何的建议,可以通过此邮箱联系我们:tnsf@microsoft.com.
- 已建议为答案 Yuki SunMicrosoft contingent staff 2020年10月29日 9:32
-
您好,
关于本问题,请问以上信息可以帮到您吗? 如果您对此问题有任何疑问或需要进一步的帮助,欢迎您随时回帖讨论。 如果问题已解决,还请您将有用的回复标记为答案,以便其他有类似问题的论坛用户更快搜索到有用信息。感谢您的理解。
此致,
Yuki Sun
如果以上回复对您有所帮助,建议您将其“标记为答复”. 如果您对我们的论坛支持有任何的建议,可以通过此邮箱联系我们:tnsf@microsoft.com.