It is surprising how many customers I see that make a specific receive connector for certain remote (internal network) IP addresses to allow anonymous internal relay.

It became surprising to me (and to them) after learning that Exchange allows anonymous relay internally by default, effectively making that additional receive connector totally superfluous.

This has been the default behavior since at least Exchange 2010 as far as I can see.

Now I'm wondering:

  • Is it really so fine/secure to allow anonymous relay internally by default (security is the reason why customers create a separate connector in the first place; so they can limit this to only a few internal devices/applications)?

  • What is the best practice? Should internal relay be limited in some way and if so, how? Normally it's a best practice not to modify the default connectors.


Yes, we need to enable "Anonymous Users" on receive connector so that we can accept message from Internet.

To prevent anonymous relay from internal, we can remove ms-exch-smtp-accept-authoritative-domain-sender permission for Anonymous Users, for example:

Get-ReceiveConnector "Default Frontend <Server>" | Get-ADPermission -user "NT AUTHORITY\Anonymous Logon" | where {$_.ExtendedRights -like "ms-exch-smtp-accept-authoritative-domain-sender"} | Remove-ADPermission

However, it does not effect on external spoofed message. To prevent it, we need deploy anti-spam firewall.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.