1

Microsoft Office 365 Top senders and recipients report shows that 15-20 % of messages in the tenant are from postmaster@example.com i.e. Office 365 Exchange sends a lot of Non-Delivery Notifications (NDN).

Testing with recipient is-microsoft-a-backscatterer@example.com from an external sender I instantly get a NDN with error 550 5.1.10, created by Office 365 instead of the sending server, proving that I can't get a connection-stage rejection even when the mailbox doesn't exists.

This makes me think Office 365 is vulnerable of sending spam backscatter. Is there any way to configure Office 365 Exchange to use connection-stage rejection, instead, when it's possible? Microsoft probably uses an arsenal of other methods for preventing backscatter. Are they powerful enough? AFAIK SMTP connection-stage rejection is the single most powerful practice against it.

1

MS evidently use other methods of preventing backscatter. If you're using EOP as the mail filter without your own MTA, then your options for customising it will be limited to what Microsoft allows you to do with their product.

Here's their guide on backscatter prevention in relation to EOP - https://docs.microsoft.com/en-us/office365/securitycompliance/backscatter-messages-and-eop

I haven't familiarised myself with how EOP works (not that MS will divulge the nuts and bolts) or how effective it is. I personally prefer to reject "bad" mail at the MTA rather than accept and filter it (and the latter seems to be the EOP approach). I used to be proud of our MTAs rejecting 93% of attempted deliveries prior to it being scanned for actual spam. And yes, I still think that is more efficient.

But perhaps whatever MS does is actually more effective in reality. Also your organisation may well not have any appetite for running your own MTA in front of Exchange Online services, so you have to be pragmatic about the options.

If the users don't get too much spam delivered to their mailboxes - in other words, you are actively tuning the options that EOP gives you, and there is no significant increase in delivered spam compared to a custom MTA - and you don't end up on the Backscatterer.org IP list, and you're not breaking the SMTP conventions (and you know how to configure your SPF correctly!) then that will be good enough.

If anyone else can do real-world comparisions of a well-managed MTA (with the usual antispam controls) and a well-managed EOP configuration, I'd be very interested in the results.

  • The linked article describes the situation, but also shows attitude that they don't see this as a problem at all. Their major concern is incoming backscatter. – Esa Jokinen Nov 1 '18 at 7:01

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.