Currently, I have an anonymous receive connector set up on my Exchange 2010 system that allows from an entire subnet. I'm looking to change this to only allow from specific IPs, but need to know when machines are being rejected. Currently, the protocol logging on the receive connector is set to verbose, and I changed the Diagnostic Logging properties on MSExchangeTransport>SmtpReceive from Lowest to Expert, but the smtp logs located in the TransportRoles\Logs\ProtocolLog\SmtpReceive directory only list connections from valid IPs, it shows nothing for blocked IPs. I even checked the message tracking logs, and nothing is shown.
To test, I would telnet from an allowed PC and just do an ehlo. That would be logged. Once that PC was no longer allowed I would do the same telnet test, it would accept the ehlo and then I would try to mailfrom, and get the 5.7.1 Client was not authenticated message that I would expect, but the logs show nothing.
Is this information kept in a different log or is there some other setting needed to show this?
