We're using Exchange 2010. We have a user who is receiving thousands of NDR messages from our Exchange server as a result of a spammer using his address to spam a ton of Yahoo and Hotmail addresses.

I've tried disabling NDR messages under Remote Domains, I've enabled RecipientValidation, no dice. How can I prevent Exchange from generating these emails?


You can't, because it isn't Exchange generating them.

The remote server is generating the messages and then sending them to your server. Your server has to accept them - attempting to block/reject them will simply cause your server to be blacklisted.

Configure SPF and DMARC records - that should help to some degree. However as you are receiving the NDRs, the real problem is the remote servers are not setup correctly to filter invalid recipients (which is probably what most of the NDRs are). Therefore they are probably not using SPF records either.

You may have to simply weather the storm - it does stop eventually.

Recipient validation wouldn't help because the recipient is valid.

  • Hotmail and Yahoo aren't using SPF? – NaOH Apr 19 '17 at 16:11
  • Both Hotmail and Yahoo use SPF records. However I would be surprised if the bulk of the emails are coming from those locations. – Sembee Apr 21 '17 at 10:35
  • You could also change his email address so he no longer gets replies to it. Yes, it means he'll have to inform everyone about the new change but it's an option. Once a spammer has an address it's not going to be let go. The transport rule mentioned by jbaldridge is also good. – Jon Apr 27 '17 at 14:43

Setup a transport rule to drop the message without notification when the recipient matches blah@blahblah.org and subject or body contains blah blah blah.

I don't have 2010 in my environment any longer so I can't give explicit instructions on how to do this. Hopefully that starts you in the right direction.

You might not want to keep this in place forever.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.