In these cases, the mail is usually UBE and is relaying to hide the source of the original spammer. There are two possible scenarios for anti-relay. One is where there is a separate machine outside the firewall that checks for e-mail for its domain. The other scenario is when there is only one machine handling both internal and external traffic. Separate machines used for internal and external mail Outside of the firewall are mail servers that handle all incoming mail from the internet.
Internal users connect to mail servers inside of the fire wall.
On the External Mail Server create a filter script that checks the Channel-to header for domains that are internal to us. Allow these through and reject all other mail. In this scenario the same machine is used for both internal and external connections. The problem we face here is that we need to allow the local users to send mail outside our domains but not allow external users to do the same. This set up is not generally recommended, since it makes the Messaging Server open to external attacks.