How to prevent internal user address from being used to send e-mail
By default, the Anonymous user permission group has the following permissions:
Ms-Exch-SMTP-Submit
Ms-Exch-SMTP-Accept-Any-Sender
Ms-Exch-SMTP-Accept-Authoritative-Domain-Sender
This permission allows senders that have e-mail addresses in authoritative domains to establish a session to this Receive connector.
Ms-Exch-Accept-Headers-Routing
To prevent emails from being sent to you by impersonating your domain name, you can use the following methods:
Method 1:
How does Exchange 2007-2010 prevent external connections from sending inward emails using local domain addresses?
By default, the Anonymous user permission group has the following permissions:
Ms-Exch-SMTP-Submit
Ms-Exch-SMTP-Accept-Any-Sender
Ms-Exch-SMTP-Accept-Authoritative-Domain-Sender
This permission allows senders that have e-mail addresses in authoritative domains to establish a session to this Receive connector.
Ms-Exch-Accept-Headers-Routing
To prevent emails from being sent by impersonating a domain name, you can use the following methods:
Method 1:
On the Exchange central transport server, run ADSIEDIT.msc. Browse to Configuration- > Services- > Microsoft Exchange- > First Organization- > Adminstrative Groups- > Exchange Administrative Group-> Servers- > server_name- > Protocols- > SMTP Receive Connector right-click Default Receive Connector and switch to the Security bar, click to select Anonymous Logon. Click to select Deny to the right of Accept Authoritative Domain Sender in the list below. Restart the Microsoft Transport services service.
Method 2:
1. Enter the following command under PowerShell:
Get-ReceiveConnector "Default SRV12-01" | Get-ADPermission-user "NT AUTHORITY\ Anonymous Logon" | where {$_ .ExtendedRights-like "ms-exch-smtp-accept-authoritative-domain-sender"} | Remove-ADPermission
Restart the Microsoft Transport services service.
Note:
Replace Default SRV12-01 with the name of your actual accept connector, note that it is the one with port 25.
