1

We have Exchange 2010. Say I am trying to prohibit users from including large attachments on internal distribution groups. I have set up a transport rule that is something like the following:

Apply rule to messages

from users that are 'Inside the organization'

  and when any of the recipients in the To or CC fields is
  'internal-list@contoso.com'

and when the size of any attachment is greater than or equal to 
'10 KB (10,240 bytes)'

send 'No attachment for you!' to sender with '5.7.999'

except when the Subject field or message body contains 'allow-attachment'

The result a user gets when this rule is triggered lists every member of the distribution list. First it lists the enhanced DSN text, and then it lists the custom message below that. For example, if abby, bashir and caroline are the members of the mailing list in question, Exchange generates a bounceback like this:

abby@contoso.com
Your message wasn't delivered because the recipient's e-mail provider rejected it.

bashir@contoso.com
Your message wasn't delivered because the recipient's e-mail provider rejected it.

caroline@contoso.com
Your message wasn't delivered because the recipient's e-mail provider rejected it.

Diagnostic information for administrators:
Generating server: mail.contoso.com
abby@contoso.com
#550 5.7.999 No attachment for you! ##
bashir@contoso.com
#550 5.7.999 No attachment for you! ##
caroline@contoso.com
#550 5.7.999 No attachment for you! ##

The problem is that the distribution group 'internal-list@contoso.com' is expanded in the message the end-user receives. I want the bounceback to eliminate the redundant information, and be more like:

internal-list@contoso.com
Your message wasn't delivered because the recipient's e-mail provider rejected it.

Diagnostic information for administrators:
Generating server: mail.contoso.com
internal-list@contoso.com
#550 5.7.999 No attachment for you! ##

but I cannot figure out how to do this (or produce something simpler that would just give the user advice about attachments). I have tried changing the condition

  and when any of the recipients in the To or CC fields is
  'internal-list@contoso.com'

to various other criteria that should match the internal list (for example, matching the "To" header in the email), but I have not found anything that works. I guess I do not understand why I can create the rule that applies to the unexpanded distribution list, but the rule appears to be applied after the distribution group is expanded.

Do you know how I can massage this rule to give a simple bounceback? Or is there a different solution that does not involve transport rules?

1

The only way I can think of for you to get what you want here is to use an intermediary account, since distribution lists will work exactly as you described.

What I mean is, setup a mailbox called "Internal List" and change your distro list to "Distro list of Internal List" and hide that distro list from the Address Books. Give "Internal List" mailbox the SMTP address that Distro list currently has and use that in your Transport Rule.

Then set the Internal list to always forward email to the distro list.

This would give you the desired effect.

HOWEVER, you then have to deal with 2 things:

  1. Instructing users that this "mailbox" is the "distro list" (the icons would look different)
  2. You wouldn't be able to manage the distro list from Outlook since it will be hidden, so if you currently have a manager or someone that can modify the distro recipients, you'd now have to handle that on the Exchange side.

All that said...if there's a way to handle this programmatically I don't know what it is...but I've seen some wild things done with the Exchange APIs from 3rd parties in the past. Maybe someone out there has a way to create a custom DSN like you need without going through the above, but that's quick and easy.

2
  • Oh yuck. This is a workaround, I guess, but I won't actually implement things this way. (Should I mark you as the answer then? Upvote you?) A variation on this might be making a user that will always be alphabetically first ("aaaaaaaaah@contoso.com") and adding this user to the group, then having two rules: a rule applied to the user which sends the DSN and a rule applied to the list which silently drops the message. – Paul Nijjar Nov 1 '14 at 4:55
  • It's up to you on upvotes/accepts. I'm cool either way. Yeah, your variation could work as well but it would technically being accepting and then dropping the message. BTW, 10KB sure is a small "large attachment" ;) – TheCleaner Nov 3 '14 at 13:58
0

Here is my hacky solution. It involves three transport rules: The first classifies the message as being over the limit, and sets two kinds of flags: adding a watchdog account to the email, and setting a header. The second rule applies to messages sent to the watchdog account: it sends the DSN. The third rule looks for the header and drops the message, so that end recipients don't get it.

This is kind of ugly but it means I do not have to change the structure of my email lists, and I do not have to add arbitrary service accounts to distribution lists that also function as security groups. If I want to include more mailing lists I can modify the first rule.

Here are the rules in detail:

Rule 01:

Apply rule to messages

from users that are 'inside the organization'

and when any of the recipients in the To or CC fields is
'internal-list@contoso.com' 

and when the size of any attachment is greater than or equal to
'10KB (10,240 bytes)'

Set 'X-Contoso-DropMessage' with 'Yes'

and add a recipient to the To field 'watchdog@contoso.com'

except when the subject field or message body contains
'allow-attachment' 

Rule 02:

Apply rule to messages

from users that are 'inside the organization' 

and when a recipient's address contains 'watchdog@contoso.com'

send 'No attachment for you!' to sender with '5.7.999'

Rule 03

Apply rule to messages

when the 'X-Contoso-DropMessage' contains 'Yes'

Delete the message without notifying anyone

One place I got stuck was setting the recipients to 'internal-list@contoso.com' . To do this, I had to set the address for this rule to an "external address", because the condition "people" only selects individual accounts in the Exchange Management Console. However, using an external address lets me type the distribution group name in.

In case it is not obvious, the watchdog account should never get mail unless I intend to set a DSN. Therefore the watchdog should not be a member of these distribution groups.

In addition, I set an OWA rule for the watchdog account to drop all messages it receives, but I think this is unnecessary.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.