0

My requirement is slightly different from this question : Only allowing authenticated user on host to relay emails to external address in Exchange Server 2013

We are using Exchange-2016 and need to send Anonymous mail(doesn't have mailbox) to external domain like Gmail from dedicated Application/DB Server which have limited access and it's IP is maintained in Exchange Server Application mail relay

For Example : Database Server IP is added in Exchange Server Application mail relay

Following mail is valid because From Mail is [email protected]

 EXEC msdb.dbo.sp_send_dbmail
        @profile_name='AutomatedMail',
        @body = 'test body',
        @from_address='AutomatedMail <[email protected]>',
        @body_format ='HTML',
        @recipients = '[email protected]',
        @subject = 'test Email';

But below mail is spoof mail and must be stopped as From Mail is [email protected] or could be my colleague(basically want to stop internal spoofing)

EXEC msdb.dbo.sp_send_dbmail
    @profile_name='AutomatedMail',
    @body = 'Kindly Transfer 10000$ to Account in my bank ASAP',
    @from_address='ManagingDirector <[email protected]>',
    @body_format ='HTML',
    @recipients = '[email protected]',
    @subject = 'Send Money urgently';

Kindly suggest if we can add list of email address in Anonymous Email address like in following command

[PS] C:\>Set-ReceiveConnector "EXSERVER\Anon Relay EXSERVER" -PermissionGroups AnonymousUsers

[PS] C:\>Get-ReceiveConnector "EXSERVER\Anon Relay EXSERVER" | Add-ADPermission -User 'NT AUTHORITY\Anonymous Logon' -ExtendedRights MS-Exch-SMTP-Accept-Any-Recipient*

is there any option -ExtendedRights MS-Exch-SMTP-Send-Filter-Sender "[email protected]; [email protected]" which allow only sending anonymous email with predefined email address?

(MS-Exch-SMTP-Send-Filter-Sender is just an example and not an actual parameter. I have limited info about exchange)

If it is not allowed then authenticated sender is always an option(or DKIM etc.)

Improve this question
2
  • Hi, it's been a while, is there any update? Please check if the below info is helpful to you, if your problem has been fixed, you could mark the best answer or share your solutions. Have a nice day:-)
    – Ivan_Wang
    Jan 4, 2021 at 1:58
  • Hi Ivan, Thanks for your suggestion but it was not useful in our case. We have raised a ticket with MS Exchange support team and waiting for their reply. I'll update this thread when we receive any response.
    – saurabh sharma
    Jan 5, 2021 at 6:52

1 Answer 1

Reset to default
0

Based on my research and knowledge, the collection of anonymous users NT AUTHORITY\ANONYMOUS LOGON is used when we would like to add / deny permissions to anonymous user, and it is created by default(What is user account 'NT AUTHORITY\ANONYMOUS LOGON'). I tried to find/modify this object, but I couldn't find any objects about it by running the following cmdlets in Powershell:

enter image description here

Therefore, it seems that we could only limit the remote IP address of client but could not limit a specific sender address: enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .