Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a .NET program -- a Windows Service -- that connects to Exchange to send email. The goal is to allow it to send email appearing to be from any number email addresses within the domains my employer owns. The program is authenticating with an Active Directory account -- called "AutoMail" -- and the problem is that Exchange is giving the following error response code:

System.Net.Mail.SmtpException: Mailbox unavailable. The server response was: 5.7.1 Client does not have permissions to send as this sender
   at System.Net.Mail.MailCommand.CheckResponse(SmtpStatusCode statusCode, String response)
   at System.Net.Mail.MailCommand.Send(SmtpConnection conn, Byte[] command, String from)
   at System.Net.Mail.SmtpTransport.SendMail(MailAddress sender, MailAddressCollection recipients, String deliveryNotify, SmtpFailedRecipientException& exception)
   at System.Net.Mail.SmtpClient.Send(MailMessage message)
   at ConsoleApplication1.Program.Main(String[] args) in C:\WorkingCode\ConsoleApplication1\ConsoleApplication1\Program.cs:line 38

When I change the network credentials to my A/D login and send email as being from me, it works with no problem.

So my question is: can the AutoMail user be configured from the Exchange side to be allowed to send email as any validly formatted email address? If so, how?

For reference, here's the C# code in use:

MailMessage mail = new MailMessage();
mail.From = new MailAddress("not-me@acme.com");
mail.To.Add("me@acme.com");
mail.Subject = "This is an email";
mail.Body = "This is a test. <b>This is bold</b> <font color=#336699>This is blue</font>";
mail.IsBodyHtml = true;
SmtpClient smtp = new SmtpClient();
smtp.Host = "172.16.1.33";
smtp.UseDefaultCredentials = false;
smtp.Credentials = new NetworkCredential("AutoMail", "password");
smtp.Send(mail);
share|improve this question

1 Answer 1

up vote 2 down vote accepted

By actually logging in via Exchange hooks, you are subject to sender validation. There are permissions that need to be set in order to impersonate someone, which was done intentionally by Microsoft. The permission you're looking for is "Send As". This kind of operation is required by a Blackberry Enterprise Server, so isn't unusual.

The way we solved it is to give the user (AutoMail in your case) a specific ACL to the Domain object in AD. The Apply To is for 'Decedent User Objects', and with only the "Send As" box checked. This will cause all User objects in the domain (unless they're in a container with rights inheritance turned off) to allow AutoMail to impersonate them.

Send-as user permission example

share|improve this answer
    
Will he have to re-apply this when he adds new users? –  BillN Jan 23 '10 at 1:01
    
Because this relies on inheritance, it should apply to all users including any new ones. –  sysadmin1138 Jan 23 '10 at 1:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.