For years, people have been asking me, "how can I make Exchange work just like sendmail,
where it rejects invalid recipients during the SMTP protocol?" Sendmail has
historically not had a directory, and so checking if a recipient was valid was just
a getpwnam() call, which is quick. Of course, when Exchange accepts a user who
is not in the directory, it will issue a non-delivery report later once it has done
a directory lookup, so Exchange is not actually open for relay as some people
might think. Accepting mail for nonexistant users in a local domain does
not meet my definition for "open for relay". For three major reasons,
Exchange has not had this feature:
Well enough people asked for this that we actually put this recipient lookup feature
into Exchange 2003. Enough people have asked me about it, and I don't see a
KB article that explains it (I'm going to mail the right people to get that solved
as well), so I wanted to quickly describe how to enable it.
Enable directory lookup for recipients in the recipient filter
Enable the recipient filter on the SMTP protocol binding that accepts mail from
Now, when someone does a RCPT TO: invaliduser@localdomain,
they will get a:
550 5.5.1 User unknown
Keep the questions about Exchange 2003 coming, I'll post the answers here so everyone
can see them.
Great tip David! Will you post back when this is put in a KB article. Also, any plans by the exchange group to look at implementing SPF records for use with Exchange?
We have been involved in a number of groups, both internet-focused and industry-focused, that are looking at how to reduce spam and spoofing on the Internet. The short answer is: yes, we are looking at implementing things like SPF to help stop spoofing.
Does Exchange 2003 support the "tarpitting" with the recipient filtering?
If so, how would it be configured?
If we have message journalling to an external SMTP address enabled. Will the forwarded emails be scanned before going out, by an Anti Virus software like Scan Mail etc..(we dont have SMTP level scanners). Do the forwarded email enter the information store and then sent out?
Todd: there is a quote from one of my co-workers in <a href="http://www.msnbc.com/news/986879.asp">this
MSNBC story</a> that talks about spf.pobox.com as well as some other things.
Oops, I forgot not to post comments within WinBlogX... sorry :-)
Karan: No that feature is not built in. We are considering it for the future.
Madura: It depends on your topology. I would say that in most cases, forwarded mails do not enter the information store to be scanned for viruses by store-based virus scanners. Many virus scanners do not have SMTP-based virus scanners, in Exchange 2003 we added a new interface to make it super-easy for them to adapt their store-based virus scanners to work on SMTP.
is there any anti-spoofing in exchange 2000?..in other words can I tell it not to accept any emails claiming to be from local mailboxes if the source IP address is not one we specify ?
Thanks for the previouse reply. I have another question on journaling. I need to journal all the emails on an Exchange 2000 server to an external smtp address and it should be 100% reliable. I have enabled journaling and it works.. But If the remote server fails (external journaled smtp address is unreachable) I dont receive any NDRs for the journaled emails. How can we avoid this situation. I need to know if an email is not journaled and I need to journal it back somehow when the remote server is up again. How can we achieve this?
I am in the process of migrating from Exchange 5.5 to Exchange 2003 for a company that has multiple small (less than 5 users) branch offices.
They want to migrate slowly, so here's my dilemma: The current Exchange 5.5 will still be active for a while. I'm using the Exchange Migration Wizard in Exchange 2003 to migrate the mailbox data over.
All incoming mail needs to be split between the two servers, as the new Exchange 2003 server will be gradually hosting more & more of the users.
Can you point me in the right direction where I can learn to write an SMTP event sink to route some recipients to one server, & others to the other? Thanks!
I can't join the Exchange 2003 server to the same Exchange 5.5 site, as it's in a different domain.
Is there any way to track the IP address of systems recieving the 550 5.5.1 errors? I have SMTP logging turned on, but I don't see anything obvious in the logs that show that the connection was rejected for this reason. I'd like to be able to keep an eye out and if a system is brute forcing I'd like to notify abuse. Anywhere that I could get this info to extract out in an automated way? I.e. can it be logged to the event log?
What about us poor guys who are still on NT 4.0 Domain and Exchange 5.5? We are getting hammered with Invalid Recepients with an originator of <> I am getting about 10,000 a day.... I need a solution....
Is there a hack to make Exchange Server 2000 or earlier check recipients in the SMTP protocol or is this only possible in 2003?
It's only built-in to Exchange 2003. It's certainly possible to write code to do it on Exchange 2000 (though not 5.5, sorry Scott, this may be your reason to start planning your upgrade to 2003!), and I believe that some of the "content management" products listed at http://www.microsoft.com/exchange/partners/emailcontent.asp do this. But if you want it built in to Exchange, you need to have Exchange 2003.