Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a Exchange 2003 the SMTP collector has the 'Delivery Restriction' configurated to deny for all except for who is in a security group mail-enabled (called 'InternetMail').

There are user mail-enabled and dummy user for shared mailbox ( think them as 'office mailbox' delegated to many users )

Some user mail-enabled and some dummy-user mail-enabled are in the InternetMail group and other no.

So far so good.

The issue is that when a user with personal mailbox is in the InternetMail group and has also access to a dummy mailbox (not in the InternetMail group) can send emails outside also from this dummy mailbox even if it is not in the group!

My guess is that the 'delivery restriction' lookup, not only look to the group-membership of the user owner of the mailbox, but also, the group-membership of the delegated user with 'send as' permission to evaluate the condition.

Maybe is by design but I need some microsoft document to certificate this behaviour or the evidence that something is not right configured in exchange. I've try a deep googling but no luck, maybe I've wrong the query...

Feel free to ask more information or clarificaton.

share|improve this question

Are you sure they are actually sending email out as that dummy user that doesn't have internet email access, or are they sending "on behalf of"? Big difference on how the email is processed and which "mailbox user" it is sent from.

You should also look at this KB article to properly understand how to restrict internet email inbound and outbound:

share|improve this answer
As I wrote user have ' send as' permission for mailbox where the owner is a dummy user. The link you post not talk about how collecton's delivery resitriction look group membership for user with send as or on behalf to permission. Thanks anyways – Christian Jun 17 '13 at 20:48
My point was more on how the emails are being sent out. Is it going out "on behalf of" or as the actual dummy mailbox when a user that has send as permissions is sending email from the dummy mailbox? – TheCleaner Jun 19 '13 at 14:51
'as the actual dummy mailbox' not 'on behalf to'. Users have 'send as' permission for the dummy mailbox. – Christian Jun 19 '13 at 15:12
OK, I don't have a test Exch2k3 server to even try this out on, but I did (sort of) follow the KB article I posted in my answer on a 2010 server to verify. If you'll take the dummy mailboxes and create invalid SMTP addresses for them and then add those email addresses as being denied outbound SMTP (for 2003 use the KB article), then you'll prevent them from sending out regardless. IF the dummy mailbox still requires the ability to receive inbound you should be able to get away with 2 SMTP addresses on it. The primary being fake (to block outbound) and a real one to allow inbound routing. – TheCleaner Jun 20 '13 at 13:17
Thank you for your time, but I'm not asking about a way to block or not outbound I'm aware of this. I'm asking for some MSFT documentation that explain how delivery restriction on connector works with user not the owner of a maibox? I hope you can follow me... – Christian Jun 20 '13 at 16:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.