Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We recently migrated form Exchange 2000 (yes I know...) to Exchange 2010 and went through the horror of configuring it. First of all we don't use ForeFront, sadly(?) we can't.

Before I ask my question here is what we've already done:

  • We have configured the Organization -> HUB -> SendConnector to be scoped to disallow mailing through us (yet another stupid name for such important option).
  • We have installed Anti-SPAM futures (for HUB if that is relevant)
  • In Sender ID filter we have set the reject option (without this some spammer was still able to send stuff through our server somehow)
  • Content filtering is disabled (it filtered out more good things then bad)
  • We've also set Accepted domains to be only from our domain.

So the question is if it is possible to set up filtering so it only works for certain IPs? Specifically to be able to send e-mails with "From" addresses outside of our domain (with Return-Path in our domain) and send e-mails without authorization from a certain IP. Effectively set an option like "we know this IP, we know it sends crap but it's our internal stuff".

share|improve this question
up vote 3 down vote accepted

Yup, it's quite easy with a Receive Connector. I do this on Exchange 2010 at my organization, for example.

Server Configuration -> Hub Transport -> Receive Connectors -> New Receive Connector

Name it something like "Trusted IP's", leave the default "listen on all interfaces on port 25" rule, then finish the wizard with defaults.

Right-click on the resulting connector and set all (and only) the IP's you want to trust under "Receive mail from remote servers that have these IP addresses" under the Network tab.

Under authentication, click "Externally Secure (for example, with IPsec). This is the magic sauce, though it's not well-explained in the GUI. It means you flat-out trust these IP's to send good mail, no matter how spammy they appear.

share|improve this answer
Great! It works fine. It's kinda strange that I cannot authenticate then, but it's not a big problem (just have two receivers - one with auth and one without). – Nux Dec 1 '10 at 9:58
Unfortunately that didn't work after all... I can send e-mails with any Return-Path (which I don't want really), but I cannot send e-mails with From set from outside of my domain. It seems to fail do to the Sender ID reject rule. – Nux Dec 1 '10 at 10:44
OK. Now it works - I just needed to add the IP to IP Allow list. – Nux Dec 1 '10 at 11:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.