It is surprising how many customers I see that make a specific receive connector for certain remote (internal network) IP addresses to allow anonymous internal relay.
It became surprising to me (and to them) after learning that Exchange allows anonymous relay internally by default, effectively making that additional receive connector totally superfluous.
This has been the default behavior since at least Exchange 2010 as far as I can see.
Now I'm wondering:
Is it really so fine/secure to allow anonymous relay internally by default (security is the reason why customers create a separate connector in the first place; so they can limit this to only a few internal devices/applications)?
What is the best practice? Should internal relay be limited in some way and if so, how? Normally it's a best practice not to modify the default connectors.