I have recently deployed exchange server 2013, and I am new to this. I am facing issue in securing exchange server.

Details: My Active directory and exchange server are remote on public IP and can be accessed VIA internet

I want only authenticated users from my domains to be able to send emails. so in Mail Flow --> receive Connectors --> Default Frontend --> Security --> I unchecked the "Anonymous users"

No problem so far, and authenticated users are able to send emails, but when i tried to send an email from my gmail account to my exchange server user i Error "530 5.7.1 Client was not authenticated"

So now situation is, If i allow "Anonymous users" for my "Receive Connectors --> “Default Frontend” I am able to receive emails from external domains like gmail etc. But that allows unauthenticated users to send emails.

On the other hand if i disable "Anonymous users", i am unable to receive emails from internet.

I tried creating a new receive connector for "Internet (For example, to receive internet mail)"

But it gives me error that port and ip bindings must be unique.

I am lost. can some one please advise what i need.



Not completely sure what you mean by:

I want only authenticated users from my domains to be able to send emails.

I think your requirement is to only allow authenticated users to relay mail through your mail server.

Based on that assumption here is my answer:

Your Exchange server is already configured to your requirements by default.

Here is how:

Exchange 2013 receives email through "Receive Connectors".

During the installation of Exchange a number of receive connectors are automatically setup for you. Read this for more info: TechNet - Receive Connectors. The one we care about in this discussion is the Default FrontEnd receive connector.

This connector is primarily responsible for receiving email from outside your organization on port 25 (SMTP). You must leave anonymous access allowed on this connector if you want to allow incoming email from the internet. This is the typical configuration unless your exchange server is behind another device such as a spam filter.

By allowing "Anonymous" users on this connector you are telling exchange to accept incoming mail from anonymous senders. But you are not allowing anonymous users to send mail through your server. Meaning, email received on this connector by an anonymous client must be destined for a mailbox inside your Exchange organization or it will be rejected.

The reason for this is a little more complex, but it comes down to the fact that checking that box for "Anonymous" only grants a certain set of permissions to anonymous user. Relaying email is not one of those granted permissions.

To summarize, you do not need to anything. Exchange, by default will not all unauthenticated users to relay mail through your server. You can test this by manually initiating a telnet session to your exchange server and trying to relay mail from an outside email address to another outside email address. You should receive an error. Details on how to do this here: TechNet - Telnet to test SMTP

  • I tried to test things as you proposed using telnet and i am able to send an email from an unknown email address.
    – Ali
    May 24 '15 at 19:01
  • what i really want is, only users@mydomain.com can send emails also all users should be authenticated that must provide password for sending emails, currently when i configure a mail account in outlook (IMAP), even if i dont check the option for outgoing server "My server require authentication", mails are going easily. do apparently the exchange is not secure and is ready for SPAM :(
    – Ali
    May 24 '15 at 19:13
  • 1
    The important bit of the telnet test is the recipient you chose. You should not be able to send an email from an external address to another external address. Your server should accept mail from an external address to an internal address. This is typical email from the internet. Likewise, Without checking "My server requires authentication" you should be able to send mail to internal users, but you should not be able to send mail to external users. Can you test this?
    – Stephen F
    May 25 '15 at 17:19
  • Yes You are right, I able to send email from any address to internal address, but when i try to send email from internal address to any outside address i get '550 5.7.1 Unable to relay', so this seems good. but i tried to configure my outlook with a fake email address from my domain, and as my outgoing server is not requiring authenitcation, i was able to send email from a FAKE@mydomain.com to my valid_address@mydomain.com - received, I also tried to send email from a FAKE@mydomain.com to my valid_address@GMAIL.COM, mail has been sent from outlook, but not received at gmail. Is this normal.
    – Ali
    May 25 '15 at 17:31
  • Yes this is normal. You are now entering the realm of spoof protection and spam filtering. It is surprising to many people when they realize that typically you can send email from any address you like. It is up to the receiving server to determine if the email is actually from a legitimate source. There are a few different mechanisms to do this including SPF records, and DKIM. Gmail has sophisticated SPAM and spoof filtering enabled which is why you will likely not receive that fake email or it will end up in your spam folder. Your exchange server is not performing any spoof checks.
    – Stephen F
    May 25 '15 at 17:55

EAC > Mail Flow > Receive connectors > edit Client Frontend, the role of FrontendTransport, "Exchange Receive Connector" window will pop up. In this window: Security > Checkbox "Anonymous users" and Save

I'm now getting email from internal to the external addresses.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.