Exchange Server Ending up on CBL List

[timberdoodle]

We have an Exchange 2010 server that is behind a Barracuda spam appliance. Recently we have started having issues where we end up on the CBL abuse list and our emails are rejected from some spam protection that utilizes these filters. After reviewing our Barracuda and Exchange logs, I see there is a small amount of spam that appears to be going through our server. The first incident was Thursday. I cleared our server from their logs, it was relisted Saturday.

Since then, I have set the rate control for clients to be 50 messages in 30 mins.
I have added a rule to the firewall to only allow port 25 outbound from the IP of the barracuda appliance.
I have run wire shark on a computer using promiscuous mode (Exchange is a VM, so is the wire shark computer). I find no traffic for smtp other than between the server and the appliance. I must be going about this wrong...
I turned off over 90% of the computers in the network - we have active antivirus on all of them with no alerted status.
I have tried limiting the receive connector on Exchange to not allow anonyomous traffic except from the barracuda. I tried just disabling anonymous access but I can't send into the network if I do that.

Help!

 

[Eickst]

Any web servers that have smtp service for iis running? Web forms etc?

Where is your barracuda appliance, network, dmz? What kind of firewall do you have?

 

[k1pp3r]

Is your mail server sending mail out of your primary WAN IP or a non-interface assigned IP?

If you send mail out of the same IP that your lan pc's use to browse the net then your asking for trouble from spam sending trojans becuase the spam comes from your main IP address.

You can solve this by locking down your firewall so only your exchange server can send SMTP out

 

[timberdoodle]

Any web servers that have smtp service for iis running? Web forms etc?

Where is your barracuda appliance, network, dmz? What kind of firewall do you have?

Logically the network is laid out like this:

Inbound:
Sonicwall rule for SMTP traffic forwards to Barracuda which resides on internal network
Barracuda SMTP destination Exchange server IP also on internal network

Outbound:
Exchange server configured with Barracuda IP as smart host send connector
Sonicwall rule for SMTP traffic permit from IP of Barracuda
Sonicwall rule for SMTP traffic deny any any

Public facing servers are Sharepoint, OWA. It could be comprimised account but I assume I should see the account being logged in/out, etc. I have tried changing the passwords on the journaling account for a Barracuda Archiver, as well as the postmaster account...

 

[Haven]

Is your Barracuda set to scan your outgoing e-mail or is it on the safe list and to be trusted with anything that is sent out? I have seen several places that white list and do not scan outgoing e-mail.

 

[timberdoodle]

No I do not have us listed in the sender filter list. The sending address is not from our domain, at least the ones that appear to be spam. I have added the most common address to the blocked senders list and it seems to have at least reduced the spam significantly, not sure how long it will last.