Exchange 2010 SMTP allows send from any user address

We discovered that when users attempt to send mail as another user through outlook it is denied unless they have specific rights to do this.    Which is what we want.    However if using tools outside outlook exchange allows the send from address to be anything.     This is not very secure as I can easily send a message as another user using and SMTP mail connecter.    

How can I correct his behavior.    I do want it to allow SMTP mail as long as the send from address is permitted by that user.

Note this is local domain mail I am referring to.   Outside our network it works as expected.
LVL 2
Zoldy2000Asked:
Who is Participating?
 
Simon Butler (Sembee)Connect With a Mentor ConsultantCommented:
It is called spoofing and is why spam is such a problem. Most spam is spoofed and a common spammer's trick is to send email using the same From domain as the Recipient.

I could send you an email with bill.gates@microsoft.com as the sender if I wished, there is nothing in the standard products that automatically could verify that it was legitimate or not.

Simon.
0
 
Simon Butler (Sembee)ConsultantCommented:
That is the standard behaviour for SMTP traffic. SMTP doesn't really pay any attention to the sender. You cannot completely eliminate it. A decent anti-spam scanner should block most of it, and you can use things like SPF records and check your own domain. However you have to be 100% correct to block it as it is very easy to block legitimate email.

Simon.
0
 
Zoldy2000Author Commented:
I am surprised this is standard behavior.   With very little effort I could send an email impersonating my boss or even the CEO?    I can't imagine that to be true standard behavior?    Are you certain?
0
All Courses

From novice to tech pro — start learning today.