1

we are using Exchange 2010 and have already setup SPF record for our authorized mail server IPs. As a test using our domain name i tried to send an e-mail from another computer on the internet which has an IP which is not listed in SPF record. Other e-mail services rejected the message due to SPF fail but our own exchange accepted it. This tells me that our Exchange is not rejecting e-mail which fail the SPF record. I enabled SenderID on our exchange to reject e-mail which fail senderID but made no difference.

Below is the SPF info i pulled out from the message header which failed SPF but got accepted by our Exchange.

Received-SPF: None (exchange2010.domainname: user@domainname does not designate permitted sender hosts)

  • A basic question, but antispam feature enabled on your hub transport server if you dont use a edge server – yagmoth555 Jun 30 '16 at 16:10
1

If your Exchange server is honoring SPF records for other domains but not yours, then you probably have your internal DNS set to be authoritative for your domain name, but you don't have the SPF record in your internal DNS servers.

Solution: Add your SPF record to your internal DNS servers.

0

The Exchange Sender ID agent will take action when the SPF status = FAIL. The SPF status for your test email = NONE. There is no SPF record so the Sender ID agent can't take any action based on the SPF record, because it doesn't exist.

  • Here is the result of SPF record check for our domain through mxtoolbox.com " v=spf1 ip4:xxx.xxx.xxx.78/29 -all" which indicates that our domain does have a SPF record somehow our Exchange is not detecting and acting on it. FYI this only happens with e-mails received using our own domain and the Exchange does act on other domains based on their SPF record. – The Knight May 6 '16 at 21:39
0

0) create an SPF record that contains your servers and the FQDN of the domain thet you want to protect. For example:

richter.hu v=spf1 ip4:82.131.210.2 ip4:195.228.143.98 -all

1) wait dns ttl time to spf record spread on the internet dns servers. You can check it with mxtoolbox.com (change to spf record).

2) install transport agent

get-transport agent & $env:ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1

and restart ms exchange transport service on edge servers.

3) run ipconfig /flushdns on your edge servers.

4)

set-senderidconfig -SpoofedDomainAction Reject 
set-senderidconfig -TempErrorAction Reject

5) restart ms exchange transport service on your edge servers.

6) send a test mail from an outside smtp server using powershell send-mailmessage cmd let.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.