This is a rather convoluted problem but I hope that someone out there has experienced a similar situation. Here are the facts of what is happening:
- We have a single Exchange 2010 server that is internet facing, hence no Edge server.
- We have several users with mailboxes in a group called NoInternetMail. This group is intended to block these users from sending and receiving internet mail. They are still allowed to receive mail from other users inside the company.
- We are achieving this block with Transport rules. The incoming rule looks like this:
- The rule has been tested and found to be working.
- Now enter the Canon copier we have on our production floor that many of these employees use, it is an ImageRunner 2270. I have created a receive connector specifically for this copier so it can send scans via SMTP on our Exchange server. The receive connector is scoped to just the copier and configured for anonymous access. I have also added the permissions to the connector allowing to send to any recipient as any sender. Also, This copier is only meant to send scans to employees, not to the internet.
- The receive connector is working, however, any emails from this Canon copier sent to a user in the NoInternetMail group are blocked by the transport rule outlined above.
- The Canon copier appears to use NTLM auth when communicating with SMTP. I have created a user called ProductionCopier in our AD and have configured the Canon copier to use this login when authenticating to the receive connector.
- The main issue is that I have tried various combinations of authenticated and anonymous connections but neither will allow the Canon to send mail to users in the NoInternetMail group. I can send email no problem anonymous or authenticated to any user outside of the NoInternetMail group.
- According to Microsoft (https://technet.microsoft.com/en-us/library/dd638183(v=exchg.141).aspx) the criteria for what is considered "Outside the Organization" does not apply here. Specifically because the Canon copier's domain name is equivalent to the authoritative domain name specified in Exchange.
I could create a mailbox for the ProductionCopier user but I'd rather not. I'm not sure what the problem is here other than maybe just incompatible setups and limited knowledge. I'm not an expert Exchange user by any means but I have spent several days researching this problem and am still at a loss.