If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.
Course Of The Month
Become a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Disable Exchange 2016 Internal Relay
Posted on 2016-08-14
Recently I setup an Exchange 2016 Server. Everything looks fine except the Exchange 2016 default Receive connector allows internal relay.
Eg: Two emails eric@abc.com and andrew@abc.com in my domain abc.com. An anonymous user can send emails to andrew@abc.com on behalf of eric@abc.com (no authentication required). But if anonymous user try to send email to jason@condoso.com using eric@abc.com, Exchange will refuse to send it.
May I know how could I do to restrict user authentication even for emails in the internal domain? I cannot disable the Anonymous users otherwise Exchange server will not receive any emails.
Eg: Two emails eric@abc.com and andrew@abc.com in my domain abc.com. An anonymous user can send emails to andrew@abc.com on behalf of eric@abc.com (no authentication required). But if anonymous user try to send email to jason@condoso.com using eric@abc.com, Exchange will refuse to send it.
May I know how could I do to restrict user authentication even for emails in the internal domain? I cannot disable the Anonymous users otherwise Exchange server will not receive any emails.
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
6
-
3
9 Comments
Active today
Internal connector should never need anon access.
Emails from the Internet do not come via the internal connector.
Emails from the Internet do not come via the internal connector.
Active 1 day ago
After Exchange Setup, there are 5 receive connectors by default. Default Frontend is the one faced to Internet and receive emails via port 25. The security settings are set as default.
I tested using SendSMTP tool. The result shows
8/15/2016 4:53:23 PM Connecting to 4.3.2.1.
8/15/2016 4:53:23 PM Connected.
8/15/2016 4:53:23 PM SMTP connection to 4.3.2.1 successful
8/15/2016 4:53:23 PM SSL status: "before/connect initialization"
8/15/2016 4:53:23 PM SSL status: "before/connect initialization"
8/15/2016 4:53:23 PM SSL status: "SSLv3 write client hello A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 read server hello A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 read server certificate A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 read server key exchange A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 read server done A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 write client key exchange A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 write change cipher spec A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 write finished A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 flush data"
8/15/2016 4:53:23 PM SSL status: "SSLv3 read finished A"
8/15/2016 4:53:23 PM SSL status: "SSL negotiation finished successfully"
8/15/2016 4:53:23 PM SSL status: "SSL negotiation finished successfully"
8/15/2016 4:53:23 PM Cipher: name = ECDHE-RSA-AES256-SHA; description = ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1
; bits = 256; version = TLSv1/SSLv3;
8/15/2016 4:53:23 PM Encoding text
8/15/2016 4:53:23 PM Disconnecting.
8/15/2016 4:53:23 PM SMTP disconnected from 4.3.2.1
8/15/2016 4:53:23 PM Disconnected.
8/15/2016 4:53:23 PM Message sent successfully.
I expected result shall be like this:
8/15/2016 4:58:17 PM Resolving hostname smtp.office365.com.
8/15/2016 4:58:17 PM Connecting to 132.245.41.98.
8/15/2016 4:58:17 PM Connected.
8/15/2016 4:58:17 PM SMTP connection to smtp.office365.com successful
8/15/2016 4:58:17 PM SSL status: "before/connect initialization"
8/15/2016 4:58:17 PM SSL status: "before/connect initialization"
8/15/2016 4:58:17 PM SSL status: "SSLv3 write client hello A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 read server hello A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 read server certificate A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 read server key exchange A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 read server certificate request A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 read server done A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 write client certificate A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 write client key exchange A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 write change cipher spec A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 write finished A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 flush data"
8/15/2016 4:58:17 PM SSL status: "SSLv3 read finished A"
8/15/2016 4:58:17 PM SSL status: "SSL negotiation finished successfully"
8/15/2016 4:58:17 PM SSL status: "SSL negotiation finished successfully"
8/15/2016 4:58:17 PM Cipher: name = ECDHE-RSA-AES256-SHA; description = ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1
; bits = 256; version = TLSv1/SSLv3;
8/15/2016 4:58:22 PM Exception: EIdSMTPReplyError SMTP; Client was not authenticated to send anonymous mail during MAIL FROM.
8/15/2016 4:58:22 PM Exception: The operation completed successfully
I tested using SendSMTP tool. The result shows
8/15/2016 4:53:23 PM Connecting to 4.3.2.1.
8/15/2016 4:53:23 PM Connected.
8/15/2016 4:53:23 PM SMTP connection to 4.3.2.1 successful
8/15/2016 4:53:23 PM SSL status: "before/connect initialization"
8/15/2016 4:53:23 PM SSL status: "before/connect initialization"
8/15/2016 4:53:23 PM SSL status: "SSLv3 write client hello A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 read server hello A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 read server certificate A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 read server key exchange A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 read server done A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 write client key exchange A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 write change cipher spec A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 write finished A"
8/15/2016 4:53:23 PM SSL status: "SSLv3 flush data"
8/15/2016 4:53:23 PM SSL status: "SSLv3 read finished A"
8/15/2016 4:53:23 PM SSL status: "SSL negotiation finished successfully"
8/15/2016 4:53:23 PM SSL status: "SSL negotiation finished successfully"
8/15/2016 4:53:23 PM Cipher: name = ECDHE-RSA-AES256-SHA; description = ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1
; bits = 256; version = TLSv1/SSLv3;
8/15/2016 4:53:23 PM Encoding text
8/15/2016 4:53:23 PM Disconnecting.
8/15/2016 4:53:23 PM SMTP disconnected from 4.3.2.1
8/15/2016 4:53:23 PM Disconnected.
8/15/2016 4:53:23 PM Message sent successfully.
I expected result shall be like this:
8/15/2016 4:58:17 PM Resolving hostname smtp.office365.com.
8/15/2016 4:58:17 PM Connecting to 132.245.41.98.
8/15/2016 4:58:17 PM Connected.
8/15/2016 4:58:17 PM SMTP connection to smtp.office365.com successful
8/15/2016 4:58:17 PM SSL status: "before/connect initialization"
8/15/2016 4:58:17 PM SSL status: "before/connect initialization"
8/15/2016 4:58:17 PM SSL status: "SSLv3 write client hello A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 read server hello A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 read server certificate A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 read server key exchange A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 read server certificate request A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 read server done A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 write client certificate A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 write client key exchange A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 write change cipher spec A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 write finished A"
8/15/2016 4:58:17 PM SSL status: "SSLv3 flush data"
8/15/2016 4:58:17 PM SSL status: "SSLv3 read finished A"
8/15/2016 4:58:17 PM SSL status: "SSL negotiation finished successfully"
8/15/2016 4:58:17 PM SSL status: "SSL negotiation finished successfully"
8/15/2016 4:58:17 PM Cipher: name = ECDHE-RSA-AES256-SHA; description = ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1
; bits = 256; version = TLSv1/SSLv3;
8/15/2016 4:58:22 PM Exception: EIdSMTPReplyError SMTP; Client was not authenticated to send anonymous mail during MAIL FROM.
8/15/2016 4:58:22 PM Exception: The operation completed successfully
Active 1 day ago
In two test, I pretend one domain user, send email to another user in the same domain without authentication.
The first log is the current config, The email sent successfully.
The second log is tested in office365 domain, the email is rejected.
I need to configure the system so it will work as second test.
The first log is the current config, The email sent successfully.
The second log is tested in office365 domain, the email is rejected.
I need to configure the system so it will work as second test.
Active today
Why on earth would you want to allow internal users to Sen I authenticated? Using what client to send?
This would be a big security risk and a daft thing to do to be honest without a Very very good reason.
This would be a big security risk and a daft thing to do to be honest without a Very very good reason.
Active 1 day ago
Yes I agree. I don't want user to send emails without authentication, no matter it is send to external domain or internal domain. But after I configured the Exchange, it is the behaviour by default. I need to know how to stop it.
Currently Port 587 has no issue. All sender need to be authenticated. But port 25, senders doesn't need to authenticated, if From and To address are in same hosted domain (I want to stop it). I cannot simply untick "Anonymous users" otherwise no email will go into the server.
Currently Port 587 has no issue. All sender need to be authenticated. But port 25, senders doesn't need to authenticated, if From and To address are in same hosted domain (I want to stop it). I cannot simply untick "Anonymous users" otherwise no email will go into the server.
Active today
Your standard internal receive connector should, assuming you use outlook clients Only accept authenticated MAPI connections. Why would you have port 25 on an internal connector?
The external connector should never be accepting emails that are from your internal users. IF it does then you become a spam trap and will have millions of emails on your server as soon as it is found out and trust me, that will not take long nowadays.
External connectors are for just that, EXTERNAL emails NOT emails from inside your organisation. the test you did is a good one and proved that your configuration is CORRECT.
Of course the best way to protect it to have an "Edge Transport Server" set up and then you can have a simple reject rule on it if an email comes into your domain with a From: address that is xxxxx@Yourdomain.com
You should never expect to see inbound smtp traffic from one of your own internal accounts.
The external connector should never be accepting emails that are from your internal users. IF it does then you become a spam trap and will have millions of emails on your server as soon as it is found out and trust me, that will not take long nowadays.
External connectors are for just that, EXTERNAL emails NOT emails from inside your organisation. the test you did is a good one and proved that your configuration is CORRECT.
Of course the best way to protect it to have an "Edge Transport Server" set up and then you can have a simple reject rule on it if an email comes into your domain with a From: address that is xxxxx@Yourdomain.com
You should never expect to see inbound smtp traffic from one of your own internal accounts.
Active 1 day ago
Port 25 is bind to Front End Transport role, which I believe it shall be the external connector. "The external connectors shall never be accepting emails that are from your internal users". This is exactly what I want but I cannot find the way to do. I cannot find from web UI. If it shall be done from PowerShell please help to provide the command of PowerShell. It is a single Exchange server deployment.
Active 1 day ago
I setup the Edge server and so far this shall be the only way to block unauthorised spam mail. I still cannot find a proper way to block the unauthorised emails without Edge server.
Featured Post
Before moving to the cloud, it is important to carefully define your db needs, plan for the migration & understand prod. environment. This wp explains how to define what you need from a cloud provider, plan for the migration & what putting a cloud solution into practice entails.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
Sometimes clients can lose connectivity with the Lotus Notes Domino Server, but there's not always an obvious answer as to why it happens.
Read this article to follow one of the first experiences I had with Lotus Notes on a client's machine, my…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment.
The video tutorial explains the basics of the Exchange server Database Availability grou…
how to add IIS SMTP to handle application/Scanner relays into office 365.
Suggested Courses
Earn Certification
HTML5 Specialist - Certification
Free withPremium
Course of the Month4 days, 21 hours left to enroll
Earn Certification
MTA - Cloud Fundamentals - 98-369
$59.00$53.10
635 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.