Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our users were getting spam messages from their own accounts (same domain/login for example madboy@company.com to madboy@company.com). This is preety standard trick and I decided to block it so that anonymous users can't send emails as @company.com.

This brought some problems on us like our printers not being able to send emails etc but I solved it with secondary smtp receiver on different port with ip restrictions.

However it seems to affect forwarding by some e-mail servers as well:

Hi. This is the qmail-send program at home.pl. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out.

: 89.14.1.26 failed after I sent the message. Remote host said: 550 5.7.1 Client does not have permissions to send as this sender

--- Below this line is a copy of the message.

Return-Path: Return-Path: Received: from mail.company.com [89.14.1.26] (HELO mail.company.com) by company.ho.pl [79.93.31.43] with SMTP (IdeaSmtpServer v0.70) id 488fcb01c2f069d9; Tue, 3 Jan 2012 09:46:55 +0100 Received: from EXCHANGE1.COMPANY ([fe80::d425:135f:b655:1223]) by EXCHANGE2.COMPANY ([fe80::193f:51ac:9316:cb27%14]) with mapi id 14.01.0355.002; Tue, 3 Jan 2012 09:46:55 +0100 From: =?iso-8859-2?Q?MadBoy?=

So basically server forwards it without affecting email address it was send with and our servers treat it like spam.

I used this command to block things:

Get-ReceiveConnector "DEFAULT Exchange2" | Get-ADPermission -user "NT AUTHORITY\Anonymous Logon" | where {$_.ExtendedRights -like "ms-exch-smtp-accept-authoritative-domain-sender"} | Remove-ADPermission

Is there anyway I can keep on receiveing things like forwards but be able to block things (except some dedicated antispam solution - this will be added later).

Also how do I "reassing" back the permissions that was removed?

EDIT to clarify:

I have a domain domain.com configured as Authorative. Couple of our users are on project for differentcompany.com which is not on our servers or anywhere close. Now when they send an email from their accounts lets say myuser@domain.com to specialalias@differentcompany.com that special alias is configured so that any email it receives it forwards to multiple people including a group alias at our domain group@domain.com and that group alias puts the email in users mailboxes.

After the email is forwarded by specialalias@differentcompany.com and it reaches our server it is denied because the forwarding done by the "external" server doesn't affect user information so for the server it seems like the myuser@domain.com was actually sender and it treats it as spam and denies it. The server at differentcompany.com just adds itself to the header that it passed thru it and doesn't modify sender at anyway (seems like this is how forwarding works).

Although I could probably allow this particular server as allowed to relay but this would seem to affect more servers/users as anyone can setup forwarding on their email back to our domain...

share|improve this question
add comment

3 Answers

Oh yes there is.

On the new Receive Connector where you employ IP restrictions, add the servers that needs to be able to forward as remote hosts, and give "NT AUTHORITY\ANONYMOUS LOGON" the ms-Exch-SMTP-Accept-Any-Sender permission, so to allow the relaying server to relay with any sender address.

Get-ReceiveConnector "The name of the IP restricted one" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "ms-Exch-SMTP-Accept-Any-Sender"

If the relaying server also needs to be able to send mails outside your own organization (I guess that is what you mean be forwarding), you might also need to grant the ms-Exch-SMTP-Accept-Any-Recipient permission

share|improve this answer
    
No I mean forwarding as normal users forwarding emails. We've got an email on domain email@something.com that automatically forwards emails to email@somethingelse.com and email@somethingelse.com was denying that forwards if the email was sent to email@something.com from someemployee@somethingelse.com. It was visible in header that when server was forwarding it and it wasn't adding email@something.com as main address sender but it left the sender address intact so basically for the server it seemed like the mail was bad.It was normal automatic forwarding rule on a server setup by one of users. –  MadBoy Jan 4 '12 at 7:47
    
Try to expand your question a little bit: How is your current receive connectors configured? What domains are currently configured as Authoritative/accepted domains on your exchange servers? –  Mathias R. Jessen Jan 4 '12 at 11:31
    
Updated main question. –  MadBoy Jan 4 '12 at 12:16
    
I'm having a hard time understanding why the other company adds your mail domain as sender address on an email that they forwarded to you –  Mathias R. Jessen Jan 4 '12 at 12:19
    
They don't do anything.. they just forward email from our domain back to our domain. It seems their server doesn't change anything in the email (so when the email is send by myuser@domain.com when it gets back to our server it's still looking like it was sent by myuser@domain.com and not by the special alias). –  MadBoy Jan 4 '12 at 12:20
show 5 more comments

To remove permission:

remove-ADPermission -Identity <receive connector> -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights ms-Exch-SMTP-Accept-Authoritative-Domain-Sender

To restore permission which solves the problem

add-ADPermission -Identity <receive connector> -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights ms-Exch-SMTP-Accept-Authoritative-Domain-Sender 

There seems to be no way around this (leaving this permision removed and have forwarding work).

share|improve this answer
add comment

For the permissions see @MadBoy.

If you know the IP of the forwarding server and your Exchange Server is facing the internet (NAT or DMZ) you can add the IP to the connector which accepts anonymous emails.

There is no need to change the port by the way. Exchange always chooses the connector with the tightest match.

Example

  • Connector 1 accepts from 10.0.0.0/8
  • Connector 2 accepts from 10.3.4.5/32
  • Connector 3 accepts from anyone

Connection comes from 10.3.4.5, Connector 2 gets choosen. Connection comes from 10.3.4.6, Connector 1 gets choosen.

Regarding your aspect of users can setup more external forwarding. If you consider mail loops and all that it is not fun at all. And if you allow user to set that up, you will run in troubles sometime. If you are able to say no to that, I would say no.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.