Open Relay Issue

[Paranoia99]

I am trying to make sure my Exchange 5.5 Server (SP 4) cannot be used as an open relay. I have set the Routing Restrictions under the IMS to "Hosts and Clients with these IP addresses" and left the list blank. I also have "accept as inbound" for the domain in question under routing. I was under the impression that this would force the RCPT TO: to only relay for a valid entry in the GAL. It seems though as long as the domain on the address is correct, it doesn't matter if the actual mailbox exists. I.e, there is no entry for dxgh@mydomain.com, but it is accepted as a valid RCPT TO:, and hence will relay. It does correctly reject other domains in the RCPT TO though, but I need it to verify against the GAL. Am I missing something?

 

[Mulligans]

Here is a technet link about Relaying this may help you find what you are missing.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/mail/excrelay.asp

 

[Paranoia99]

Ok, I've looked at all the resources I've been able to get my hands on. The way I understand it is, that choosing a domain to route as "inbound only" under Routing in IMS (while "Reroute incoming SMTP mail" option is selected) is what controls checking for a valid entry in the GAL as a condition of relaying. So what constitutes a "valid entry in the GAL"? Does any address matching @mydomain.com qualify as a valid entry in the GAL? Is there some kind of pattern matching going on? Any help understanding this would be greatly appreciated.