Only allowing Limited Set of Anonymous user to relay emails to external address in Exchange Server 2016

Question

My requirement is slightly different from this question : Only allowing authenticated user on host to relay emails to external address in Exchange Server 2013

We are using Exchange-2016 and need to send Anonymous mail(doesn't have mailbox) to external domain like Gmail from dedicated Application/DB Server which have limited access and it's IP is maintained in Exchange Server Application mail relay

For Example : Database Server IP is added in Exchange Server Application mail relay

Following mail is valid because From Mail is help@myCompanydomain.in

 EXEC msdb.dbo.sp_send_dbmail
        @profile_name='AutomatedMail',
        @body = 'test body',
        @from_address='AutomatedMail <help@myCompanydomain.in>',
        @body_format ='HTML',
        @recipients = 'coolBuddy1980@gmail.com',
        @subject = 'test Email';

But below mail is spoof mail and must be stopped as From Mail is CMD@myCompanydomain.in or could be my colleague(basically want to stop internal spoofing)

EXEC msdb.dbo.sp_send_dbmail
    @profile_name='AutomatedMail',
    @body = 'Kindly Transfer 10000$ to Account in my bank ASAP',
    @from_address='ManagingDirector <CMD@myCompanydomain.in>',
    @body_format ='HTML',
    @recipients = 'Victim@gmail.com',
    @subject = 'Send Money urgently';

Kindly suggest if we can add list of email address in Anonymous Email address like in following command

[PS] C:\>Set-ReceiveConnector "EXSERVER\Anon Relay EXSERVER" -PermissionGroups AnonymousUsers

[PS] C:\>Get-ReceiveConnector "EXSERVER\Anon Relay EXSERVER" | Add-ADPermission -User 'NT AUTHORITY\Anonymous Logon' -ExtendedRights MS-Exch-SMTP-Accept-Any-Recipient*

is there any option -ExtendedRights MS-Exch-SMTP-Send-Filter-Sender "help@myCompanydomain.in; noreply@myCompanydomain.in" which allow only sending anonymous email with predefined email address?

(MS-Exch-SMTP-Send-Filter-Sender is just an example and not an actual parameter. I have limited info about exchange)

If it is not allowed then authenticated sender is always an option(or DKIM etc.)

Hi, it's been a while, is there any update? Please check if the below info is helpful to you, if your problem has been fixed, you could mark the best answer or share your solutions. Have a nice day:-) — Ivan_Wang, Jan 04 '21 at 01:58
Hi Ivan, Thanks for your suggestion but it was not useful in our case. We have raised a ticket with MS Exchange support team and waiting for their reply. I'll update this thread when we receive any response. — saurabh sharma, Jan 05 '21 at 06:52

score 0 · Accepted Answer · answered Dec 29 '20 at 06:34

Based on my research and knowledge, the collection of anonymous users NT AUTHORITY\ANONYMOUS LOGON is used when we would like to add / deny permissions to anonymous user, and it is created by default(What is user account 'NT AUTHORITY\ANONYMOUS LOGON'). I tried to find/modify this object, but I couldn't find any objects about it by running the following cmdlets in Powershell:

Therefore, it seems that we could only limit the remote IP address of client but could not limit a specific sender address:

Only allowing Limited Set of Anonymous user to relay emails to external address in Exchange Server 2016

1 Answers1