When I was checking into a network slowdown about a week ago, I found that there were a high number of NDR messages (one queue had over 5,000) in our outbound queues.
A massive NDR attack could have caused the bandwidth problems that users were experiencing on that day.
So, I decided to enable Recipient Filtering of Exchange 2003 and the Tar Pit feature of Windows 2003. The changes to the SMTP protocols were made on both the Front-End (FE) and the Back-End (BE) Exchange servers, but the registry change was only made on the FE Exchange server (by design). I will monitor the solution and see if it cuts down on the NDRs in the queue.
http://support.microsoft.com/kb/886208 for information on how to configure these settings.
