Receiving spam email from spoofed internal sender on Exchange 2010 SP3 with Symantec Mail Gateway


I'm confused and need your help here with the issue of receiving internally spoofed spam address but the IP address is kept on changing from country to country.

The Email is filtered first by Symantec Email Gateway appliance and then forwarded to the Exchange Server. But I'm not sure if this is Exchange Server issue or Symantec problem ?

When I read this blog, it suggest the below powershell script:

Get-ReceiveConnector “My Internet ReceiveConnector” | Get-ADPermission -user “NT AUTHORITY\Anonymous Logon” | where {$_.ExtendedRights -like “ms-exch-smtp-accept-authoritative-domain-sender”} | Remove-ADPermission

Open in new window

but there are multiple Receive connector here in my Exchange Server 2010 SP3:

[PS] C:\>Get-ReceiveConnector | Get-ADPermission -user “NT AUTHORITY\Anonymous Logon” | where {$_.ExtendedRights -like “ms-exch-smtp-accept-authoritative-domain-sender”} | ft -AutoSize

Identity                      User                           Deny  Inherited
---------------------------   ----------------------------   ----- ---------
MAIL01-VM\External Relay      NT AUTHORITY\ANONYMOUS LOGON 	 False False
MAIL02-VM\External Relay      NT AUTHORITY\ANONYMOUS LOGON 	 False False

[PS] C:\>Get-ReceiveConnector | ft -AutoSize

Identity                      Bindings              Enabled
---------------------------   --------------------- -------
MAIL01-VM\Default MAIL01-VM   {:::25,}   True
MAIL01-VM\Client MAIL01-VM    {:::587,} True
MAIL02-VM\Default MAIL02-VM   {:::25,}   True
MAIL02-VM\Client MAIL02-VM    {:::587,} True
MAIL01-VM\Inbound SMTP Relay  {}        True
MAIL02-VM\Inbound SMTP Relay  {}        True
MAIL01-VM\External Relay      {}        True
MAIL02-VM\External Relay      {}        True
MAIL01-VM\UCCX MAIL01-VM      {}          True
MAIL02-VM\UCCX MAIL02-VM      {}          True

Open in new window

So I'm confused which Receive connector should I be running the powershell script against ?

What's the roll back plan if email flow is affected when executing the wrong powershell against incorrect Receive connector ?

LVL 12
Senior IT System EngineerSenior Systems EngineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Senior IT System EngineerSenior Systems EngineerAuthor Commented:
Note: --> the load balancer virtual IP and the Windows NLB name --> MAIL01-VM IP address (HT/CAS role) --> MAIL02-VM IP address (HT/CAS role)
The generation of the email  is neither the fault of the gateway nor exchange.

I am not sure I understand what you are looking to accomplish.

If the issue is a configuration question on the Symantec gateway, you could remove a rule if you gave whitelisting your internal addresses.

You could impose a rule on the gateway to reject/sequester any email whose sender is on the internal domain.
Senior IT System EngineerSenior Systems EngineerAuthor Commented:
The problem is that more than half of my users received email from from which the IP address of the sender is kept on changing along with te subject.

It sends malicious MS Word document with Macro in it.

So how to block the mail coming from external IP while the sender is spoofed from my internal ?

When I execute this powershell command Get-TransportServer | Get-Queue, there is no email send or receive queue.
Price Your IT Services for Profit

Managed service contracts are great - when they're making you money. Yes, you’re getting paid monthly, but is it actually profitable? Learn to calculate your hourly overhead burden so you can master your IT services pricing strategy.

I am not sure what you are asking.

Is the ip that connects to your Symantec gateway outside your LAN?
Looking at the message trace on exchange as well as on the email gateway ....

The sender email is not verified only the destination is.
It is likely that if you have an mfc that has scan to email capability and it is using the it means that a scan to email was used once and sent to a user whose system became infected .........

What do you want to do?
If your users and policy is that any email using has to use the outgoing mail server that is separate from the MX, you can impose a rule on the gateway not to accept any email from a sender on the
Senior IT System EngineerSenior Systems EngineerAuthor Commented:
Hi Arnold,

I've verified with multiple site offices, there is no MFC or scanner devices with the email sender as

This spam issue is happening since yesterday and bombards most of my users companywide.

The IP that connects to my Symantec Gateway appliance is the same as the IP VLAN of the Exchange Servers. (same within the same VLAN).

But the email sender IP address which says the sender from always comes from external public IP address randomly.
One option is to add the email in question to the block list on the gateway.

Do you have a sample of the full message headers?
Have you scanned your systems, include login logs to make sure one of your user accounts was not compromised and is being used to send?

Add a server rule on exchange to divert any email from

Do you want to block/reject messages when the sender is
Look at implementing domain keys, SPF and configuring the Symantec email gateway to enforce it.
Senior IT System EngineerSenior Systems EngineerAuthor Commented:
OK so How to enable SPF ?

Do I need to make request to the ISP to put something in the DNS or this can be done from my Windows server internal DNS server ?
Senior IT System EngineerSenior Systems EngineerAuthor Commented:

Does some of the receive connector must be modified to prevent this type of issue happening ?
See the description.
It has a tool that will help you create the string that you would use managing your public record and your internal DNS to make sure whether your appliance uses your internal or has its own DNS server .......
Initially try relaxed option ~all or ?all
You would then would configure your email gateway to also rely/react to SPF data. Note that if available, I think it will enforce on all incoming, so using relaxed initially would be advisable.
Can you identify the connector on which these emails enter?  Look at the folk message headers.
Senior IT System EngineerSenior Systems EngineerAuthor Commented:
So how do I get the receive connector information from the email header in the outlook ?
view full message/headers or view source.  Which outlook do you have?  I think certain version no longer have the option to view the full message headers.

See if in the message listing pane, right click on the message and look at the message detail.
Over the versions there were different options, view full headers, view message source, view message detail, etc...
Senior IT System EngineerSenior Systems EngineerAuthor Commented:
I'm using Outlook 2013 here's what I can see from the email header:

Received: from ( by ( with Microsoft SMTP Server id; Thu, 22 Oct 2015 10:17:13 +1100
X-AuditID: c0a80257-f79ef6d000007003-40-56281cf59a87
Received: from [] (Unknown_Domain []) by (Symantec Messaging Gateway) with SMTP id A7.D3.28675.6FC18265; Thu, 22 Oct 2015 10:17:13 +1100 (EST)
From: <>
Subject: Message from "RNP002673A5A8F3"
To: <>
Date: Thu, 22 Oct 2015 02:17:04 +0300
Message-ID: <>
MIME-Version: 1.0
Content-Type: multipart/mixed;
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprOKsWRWlGSWpSXmKPExsWieuNtne5PGY0wg73zhS2ObJnC6sDoMWPO
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-AVStamp-Mailbox: SYMANTEC;559153216;0;info

Open in new window

What options do you have configured on your gateway?
Do you currently impose restrictions I.e. Spam, virus blocking?.

It looks as though the messages in question are a result of features on Symantec gateway. I.e. Messages determined to be spam, virus laden get marked and sent from to prevent bounce backs

What logs you have on the gateway?

Look at the last received line deals with gateway connecting to the server that actually delivered the message to the recipient.

Look on that system for the SMTP connector that is listening on port 25 and bound to or meaning it listens on port 25 of every ip the system has.
Senior IT System EngineerSenior Systems EngineerAuthor Commented:
ok, from Exchange Message Tracking log it is coming from this one connector:

Identity                      Bindings              Enabled
---------------------------   --------------------- -------
MAIL01-VM\UCCX MAIL01-VM      {}          True

Open in new window

what do  I need to do ?
The log is the exchange of message between your Symantec gateway and your server.
The inbound connection from external sources lands on the Symantec gateway you need to look there and depending on what IT IS you want to end with, you would look there.

What is Symantec email gateway configuration? What is it supposed to do when a message is spam? What do you want to happen if these messages are consequences of received quaranteen spam?

Check whether your Symantec email gateway configuration reflects as the configured email set there.

What do you hope to end up with at the conclusion of this?
Senior IT System EngineerSenior Systems EngineerAuthor Commented:
Arnold, my expectation is to stop or block this email with malicious attachment from

if it is spoofed from the internal then it won't be in the Symantec Messaging gateway.
if it is coming from the outside which is more likely, then why it is going through the Symantec Mail Gateway ? --> this is still a mystery.
Check the configuration of your Symantec gateway as that is where the block gas to be imposed.
By the look of the message detail the information contained there is :
1) the external source server 37.
2) the message went through the email gateway,
3) delivered to the exchange server.

Brightmailtracker I think is the header the Symantec email gateway sets.

Compare the detail of a regularly received email that is external in origin.
Your question in why it is going through email gateway presumably your configuration is

iNternet => Symantec email incoming filter gateway => internal exchange server/s.
Senior IT System EngineerSenior Systems EngineerAuthor Commented:
yes, that's correct Arnold

Internet => Symantec email mesasging gateway appliance => 2x Windows NLB Exchange Server 2010 SP3.
Check the configuration of the Symantec email gateway to see what is expected of it.

It look as the destination of the email is is that a distribution group in your exchange server?
What settings are you imposing on the incoming traffic into the Symantec mail gateway, what does it supposed to do when an email is a spam, virus laden,?
Given the setup and given the record of the example message.
It looks as though an email originating at however, it is unclear whether the information that is then forwarded to is not as configured when an email matches a criteria, its contents are forwarded to to per configuration.

Try the following,
using an email provider outside your domain. Send a test message to your address.
Make sure to masquerade the email address, destination and sender and post the message detail of it.

I am trying to see whether based on the email above is generated internally on the Symantec gateway as a consequence of the message matching a rule and brightmail rule forwards the message as an attachment to the configured destination.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.