Hi All,

I would like to know if it's possible to setup a kind of buffer for outbound mails.
We would like to be able to have a copy of the mails and, if needed, we can resend the e-mails.

I've looked into the following options, but it seems they're not what we're looking for:

- Catch All mailbox: get's a copy, but resending e-mails as the Catch-All mailboxuser, not the original sender
- Journalling: same as the above.

Are there any other options?

Thanks in advance.

Kind regards,

Matthijs

hi, i have Exchange 2013 CU8,   some days ago i notice that i receive mail from me@domain.com to me@domain.com,    i check and i create SPF Record and Configure Sender ID, but Email come again,

here is config of SenderID,   what can i Check, what can be reason?

i, also, saw this instruction

https://support.symantec.com/en_US/article.HOWTO124678.html

but cant find any answer, i disable Content Fultering and check from telnet,  mail Sent, outside of organization

no any error like this "550 5.7.1 Sender ID (PRA) Not Permitted"

how fix this issue?

Hi,

I am experiencing an issue of one overseas IP connecting to my exchange servers and sending huge number of spams with blank sender id..

1) how do an exchange client connect to my servers without user ID authentication (or do spammers have mechanism to do so?)

2)where/which log I should check to know which user ID authentication spammer is using ?

3) still spammers are sending the spam emails (include the money transfer and adulatory spams..) 

4) NOTE: since 'out of Office auto reply' is mandatory business requirement, I am unable to disable blank sender emails.

Please suggest how to prevent these type of spams?

example of message tracking log follows:

RunspaceId              : 1858bdeb-c7ad-4c8f-826d-b8e010771637
Timestamp               : 7/31/2016 5:10:05 AM
ClientIp                     : 24.128.188.200
ClientHostname        : [192.168.0.106]
ServerIp                   : My Exchange server HUB IP
ServerHostname      : My Exchange Hub server
SourceContext         : 08D38E3DF9AEB7F3;2016-07-31T01:04:31.917Z;0
ConnectorId             : MyHUbServer\authenthicated internet
Source                     : SMTP
EventId                    : RECEIVE
InternalMessageId    : 34758820
MessageId               : <79defd66-cf6d-4ba9-be97-7795d23c08bc@TEB-HD-HUB-03.hosting.local>
Recipients                : {paul.kuah@gmail.com, vadim@manager-erp.com, vani6a@abv.bg, martinrojas@wp.pl, puttersonly@mt
                          s.net, petervillarreal@hotmail.com, opaluch1@wp.pl, adzame@gmail.com, moulins7@postmail.ch, e
                          dytaose@wp.pl, afulei@freemail.hu, teju@live.fr, msjc901@yahoo.com, carlosqmesa@gmail.com, ke
                          vinfonseca70@yahoo.com, d_stanisic@hotmail.com...}
RecipientStatus         : {}
TotalBytes               : 2399
RecipientCount         : 20
RelatedRecipientAddress :
Reference                :
MessageSubject       : RE:Can I Trust You Please?
Sender                     :
ReturnPath               : <>
MessageInfo             : 07I: NTS:
MessageLatency       :
MessageLatencyType   : None
EventData                : {[FirstForestHop, MyHubServer.hosting.local]}

thanks and regards,

I have installed the Connection Filtering agent:

Install-TransportAgent -Name "Connection Filtering Agent" -TransportService FrontEnd -TransportAgentFactory"Microsoft.Exchange.Transport.Agent.ConnectionFiltering.ConnectionFilteringAgentFactory" -AssemblyPath "C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\agents\Hygiene\Microsoft.Exchange.Transport.Agent.Hygiene.dll"

Add-IPBlockListProvider -Name zen.spamhaus.org -LookupDomain zen.spamhaus.org -AnyMatch $true -Enabled $true

Enable-TransportAgent -TransportService FrontEnd -Identity "Connection Filtering Agent"

Restart-Service MSExchangeFrontEndTransport

After this, it doesn't work. Email from ip addresses marked as blacklisted (as can be seen by test-ipblocklistprovider) aren't blocked. Besides, no logging is created in “C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\AgentLog”

Specified cast is not valid. 

You know you're an engineer when you have no life and can prove it mathematically

Hello,

I have created a Transport rule on Exchange 2010 for emails with a blank subject. my rule looks like this....

When any of the recipients in the to field is 'Test@test.co.uk'

and when the subject field contains '^$'

prepend message subject with 'New Starter'

and copy the message to 'anothertest@test.co.uk'

When I have tested this anothertest@test.co.uk receives the email but with the blank subject. Every page and forum I have been on says that the ^$ is the prefix for 'Blank Subject' but this is does not seem to be working for me.

Any help would be very much appreciated.

hi, i have Exchange 2013 CU8,   some days ago i notice that i receive mail from me@domain.com to me@domain.com,    i check and i create SPF Record and Configure Sender ID, but Email come again,

here is config of SenderID,   what can i Check, what can be reason?

i, also, saw this instruction

https://support.symantec.com/en_US/article.HOWTO124678.html

but cant find any answer, i disable Content Fultering and check from telnet,  mail Sent, outside of organization

no any error like this "550 5.7.1 Sender ID (PRA) Not Permitted"

how fix this issue?

I'm trying to configure a transport rule in Exchange 2013 to block all emails from the TLD .eu   We get nothing but a TON of spam that is not caught by the Exchange 2013 spam filter, and it's always from a different domain. I have seen guides for 2007 and 2010, but nothing for 2013.

Do I just use the rule "The sender domain is" and use the value ".eu"? I just want to verify this is the correct way to block a TLD.

I currently have a hybrid environment with Office 365 and Exchange 2013 where all mailboxes reside in 365 but Exchange is used for SMTP relay of various applications/devices. Up until now everything that has had to utilize SMTP relay has been on our internal network so I setup the receive connectors on the CAS servers but now we need some non-domain joined application servers in azure to be able to SMTP relay and I can't seem to get it to work. I created a receive connector on the edge server for relay, added the necessary remoteIPRanges for the application servers but when testing with a simple send-mailmessage command in powershell I receive the following error "Send-MailMessage : Unable to connect to the remote server".

Is it because it only has the Hub Transport role installed or possibly because the permission group is only set to AnonymousUsers rather than AnonymousUsers and Custom like my CAS servers are?  Any help would be greatly appreciated. 

we have 2 exchange 2013 servers in a DAG. Each server is in a separate site.

these servers have recently been built into a live environment after migration from sbs 2011

psex01 first server built and was working ok, then added psex2 as dag member and have been testing it works after failover.

the failover worked but could not access management console on that server after failover redirected to owa.

decided to update exchange to U13 to see if resolved issues.

yesturday ran schema update on DC in same site as psex01 and suceeded

checked AD and replication good dcdiag good

but this morning getting the following error in event viewer on psex01; I deleted the send connectors and recreated them but still drops them. the path in adsiedit is correct for the connector.

what could be the issue?

Log Name:      Application
Source:        MSExchangeTransport
Date:          04/08/2016 19:11:16
Event ID:      5016
Task Category: Routing
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      PSEX01.******.local
Description:
Microsoft Exchange could not discover any route to connector CN=ALL_SMTP,CN=Connections,CN=Exchange Routing Group (DWBGZMFD01QNBJR),CN=Routing Groups,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=*********,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=platinumrails,DC=local in the routing tables with the timestamp 04/08/2016 18:11:16. This connector will not be used.  Total source server count: 1; unknown source server count: 0; unrouted source server count: 0; non-active source server count: 1.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeTransport" />
    <EventID Qualifiers="49156">5016</EventID>
    <Level>2</Level>
    <Task>4</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2016-08-04T18:11:16.000000000Z" />
    <EventRecordID>664272</EventRecordID>
    <Channel>Application</Channel>
    <Computer>PSEX01.*******.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>CN=ALL_SMTP,CN=Connections,CN=Exchange Routing Group (DWBGZMFD01QNBJR),CN=Routing Groups,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=*******,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=platinumrails,DC=local</Data>
    <Data>04/08/2016 18:11:16</Data>
    <Data>1</Data>
    <Data>0</Data>
    <Data>0</Data>
    <Data>1</Data>
  </EventData>
</Event>

cheers Mike

Greetings,

We're trying to roll out TLS 1.2 in our test environment and can't seem to get Exchange to work with the protocol.

We've been using this method to enable TLS 1.2 (and disable the other protocols - TLS1.0, SSL2.0, SSL3.0, PCT1.0): http://www.adminhorror.com/2011/10/enable-tls-11-and-tls-12-on-windows_1853.html

We originally tried using Exchange 2010 on 2008 R2, but then I ran across this article saying that it is not supported: http://support.microsoft.com/kb/2709167/en-us

We've since tried to set it up with Exchange 2013 on Server 2012. Still no luck. The only time Exchange wants to work is when TLS1.0 is enabled.

I suspect that TLS1.1 and TLS 1.2 are also not supported on Exchange 2013, or that I'm changing the wrong registry keys, but I wanted to find confirmation. I've searched extensively and can't find any documentation leading me to believe one way or the other if it's supported.

Any help or insight would be greatly appreciated. Thanks!

--Aric

hi, i have Exchange 2013 CU8,   some days ago i notice that i receive mail from me@domain.com to me@domain.com,    i check and i create SPF Record and Configure Sender ID, but Email come again,

here is config of SenderID,   what can i Check, what can be reason?

i, also, saw this instruction

https://support.symantec.com/en_US/article.HOWTO124678.html

but cant find any answer, i disable Content Fultering and check from telnet,  mail Sent, outside of organization

no any error like this "550 5.7.1 Sender ID (PRA) Not Permitted"

how fix this issue?

Hi All,

On Exchange server 2013 CU8, I am trying to create a Policy Tip. 

If an email is sent to yahoo.com and hotmail.com a policy tip should be displayed to the sender, but they can override it with business justification.

I create a custom DLP policy and then based upon the scenario, I create the rule but while trying to save the rule it gives error.

"One of the conditions you specified can't be used for rules where you want to notify the sender. Error details: The NotifySender action isn't compatible with 'RecipientDomainIs' predicate."

Any idea or work around to achieve the scenario is appreciated. 

Thanks.

Gautam.

Hi,

I've installed Edge Role of Exchange 2013 sp1 in Windows server 2012 R2 standard.
I want to use Edge server only to rewriting header.
I want to rewrite sender address from test@mydomain.local to support@mydomain.local.

Receive connector settings:

PS C:\Windows\system32> Get-ReceiveConnector cpacentrale1 |fl
AuthMechanism                           : None
Banner                                  :
BinaryMimeEnabled                       : True
Bindings                                : {0.0.0.0:25}
ChunkingEnabled                         : True
DefaultDomain                           :
DeliveryStatusNotificationEnabled       : True
EightBitMimeEnabled                     : True
BareLinefeedRejectionEnabled            : False
DomainSecureEnabled                     : False
EnhancedStatusCodesEnabled              : True
LongAddressesEnabled                    : False
OrarEnabled                             : False
SuppressXAnonymousTls                   : False
ProxyEnabled                            : False
AdvertiseClientSettings                 : False
Fqdn                                    : AppSrv2.mydomain.local
ServiceDiscoveryFqdn                    :
TlsCertificateName                      :
Comment                                 :
Enabled                                 : True
ConnectionTimeout                       : 00:05:00
ConnectionInactivityTimeout             : 00:01:00
MessageRateLimit                        : 600
MessageRateSource                       : IPAddress
MaxInboundConnection                    : 5000
MaxInboundConnectionPerSource           : 20
MaxInboundConnectionPercentagePerSource : 2
MaxHeaderSize                           : 128 KB (131,072 bytes)
MaxHopCount                             : 60
MaxLocalHopCount                        : 12
MaxLogonFailures                        : 3
MaxMessageSize                          : 35 MB (36,700,160 bytes)
MaxProtocolErrors                       : 5
MaxRecipientsPerMessage                 : 200
PermissionGroups                        : AnonymousUsers, Custom
PipeliningEnabled                       : True
ProtocolLoggingLevel                    : None
RemoteIPRanges                          : {10.3.54.2}
RequireEHLODomain                       : False
RequireTLS                              : False
EnableAuthGSSAPI                        : False
ExtendedProtectionPolicy                : None
LiveCredentialEnabled                   : False
TlsDomainCapabilities                   : {}
Server                                  : AppSrv2
TransportRole                           : HubTransport
SizeEnabled                             : Enabled
TarpitInterval                          : 00:00:05
MaxAcknowledgementDelay                 : 00:00:30
AdminDisplayName                        :
ExchangeVersion                         : 0.1 (8.0.535.0)
Name                                    : CpaCentrale1
DistinguishedName                       : CN=CpaCentrale1,CN=SMTP Receive Connectors,CN=Protocols,CN=AppSrv2,CN=Servers,CN=Exchange
                                          Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First
                                          Organization,CN=Microsoft
                                          Exchange,CN=Services,CN=Configuration,CN={457EE1D7-B7DB-4232-B725-11273EDECBE4}
Identity                                : AppSrv2\CpaCentrale1
Guid                                    : a3694ca5-179f-4846-aeac-34a13e7cbfb5
ObjectCategory                          : CN=ms-Exch-Smtp-Receive-Connector,CN=Schema,CN=Configuration,CN={457EE1D7-B7DB-4232-B725-11
                                          273EDECBE4}
ObjectClass                             : {top, msExchSmtpReceiveConnector}
WhenChanged                             : 17/06/2016 10:17:34
WhenCreated                             : 15/06/2016 16:32:57
WhenChangedUTC                          : 17/06/2016 08:17:34
WhenCreatedUTC                          : 15/06/2016 14:32:57
OrganizationId                          :
OriginatingServer                       : localhost
IsValid                                 : True
ObjectState                             : Unchanged

Receive connector permissions:

PS C:\Windows\system32> Get-ReceiveConnector cpacentrale1 |Get-ADPermission |select user,extendedrights
User                                                               ExtendedRights
----                                                               --------------
NT AUTHORITY\ANONYMOUS LOGON                                       {ms-Exch-SMTP-Accept-Any-Sender}
NT AUTHORITY\ANONYMOUS LOGON                                       {ms-Exch-SMTP-Accept-Any-Recipient}
NT AUTHORITY\ANONYMOUS LOGON                                       {ms-Exch-Accept-Headers-Routing}
NT AUTHORITY\ANONYMOUS LOGON                                       {ms-Exch-SMTP-Submit}
NT AUTHORITY\ANONYMOUS LOGON                                       {ms-Exch-SMTP-Accept-Authoritative-Domain-Sender}
NT AUTHORITY\SYSTEM
NT AUTHORITY\NETWORK SERVICE
BUILTIN\Administrators
S-1-527723813-3342083303-519

SendConnector settings (I forward to a simple intranet Microsoft smtp ):

PS C:\Windows\system32> Get-SendConnector|fl
AddressSpaces                : {smtp:*;1}
AuthenticationCredential     :
CloudServicesMailEnabled     : False
Comment                      :
ConnectedDomains             : {}
ConnectionInactivityTimeOut  : 00:10:00
DNSRoutingEnabled            : False
DomainSecureEnabled          : False
Enabled                      : True
ErrorPolicies                : Default
ForceHELO                    : False
Fqdn                         :
FrontendProxyEnabled         : False
HomeMTA                      :
HomeMtaServerId              :
Identity                     : To SmtpCpaCentrale
IgnoreSTARTTLS               : False
IsScopedConnector            : False
IsSmtpConnector              : True
MaxMessageSize               : 35 MB (36,700,160 bytes)
Name                         : To SmtpCpaCentrale
Port                         : 25
ProtocolLoggingLevel         : None
RequireOorg                  : False
RequireTLS                   : False
SmartHostAuthMechanism       : None
SmartHosts                   : {smtpcpacentrale.mydomain.local}
SmartHostsString             : smtpcpacentrale.mydomain.local
SmtpMaxMessagesPerConnection : 20
SourceIPAddress              : 0.0.0.0
SourceRoutingGroup           : Exchange Routing Group (DWBGZMFD01QNBJR)
SourceTransportServers       : {}
TlsAuthLevel                 :
TlsCertificateName           :
TlsDomain                    :
UseExternalDNSServersEnabled : False

Permission on send connector

PS C:\Windows\system32> Get-sendConnector "to smtpcpacentrale" |Get-ADPermission |select user,extendedrightsUser                                

User                                                               ExtendedRights
----                                                               --------------
NT AUTHORITY\ANONYMOUS LOGON                                       {ms-Exch-Send-Headers-Routing}
MS Exchange\Partner Servers                                        {ms-Exch-Send-Headers-Routing}
MS Exchange\Hub Transport Servers                                  {ms-Exch-Send-Headers-Forest}
MS Exchange\Hub Transport Servers                                  {ms-Exch-Send-Headers-Organization}
MS Exchange\Hub Transport Servers                                  {ms-Exch-SMTP-Send-XShadow}
MS Exchange\Hub Transport Servers                                  {ms-Exch-SMTP-Send-Exch50}
MS Exchange\Hub Transport Servers                                  {ms-Exch-Send-Headers-Routing}
MS Exchange\Edge Transport Servers                                 {ms-Exch-Send-Headers-Forest}
MS Exchange\Edge Transport Servers                                 {ms-Exch-Send-Headers-Routing}
MS Exchange\Edge Transport Servers                                 {ms-Exch-SMTP-Send-XShadow}
MS Exchange\Edge Transport Servers                                 {ms-Exch-Send-Headers-Organization}
MS Exchange\Edge Transport Servers                                 {ms-Exch-SMTP-Send-Exch50}
MS Exchange\Externally Secured Servers                             {ms-Exch-Send-Headers-Routing}
MS Exchange\Externally Secured Servers                             {ms-Exch-SMTP-Send-Exch50}
MS Exchange\Legacy Exchange Servers                                {ms-Exch-SMTP-Send-Exch50}
MS Exchange\Legacy Exchange Servers                                {ms-Exch-Send-Headers-Routing}
BUILTIN\Administrators
S-1-527723813-3342083303-519
NT AUTHORITY\SYSTEM
NT AUTHORITY\NETWORK SERVICE

Address Rewriting Outbound Agent enabled (through Get-Transport cmdlet).
Address rewriting setting:

PS C:\Windows\system32> Get-AddressRewriteEntry test |fl
InternalAddress   : test@mydomain.local
ExternalAddress   : support@mydomain.local
ExceptionList     : {}
OutboundOnly      : True
AdminDisplayName  :
ExchangeVersion   : 0.1 (8.0.535.0)
Name              : test
DistinguishedName : CN=test,CN=Email Entries,CN=Address Rewrite Configuration,OU=MSExchangeGateway
Identity          : CN=test,CN=Email Entries,CN=Address Rewrite Configuration,OU=MSExchangeGateway
Guid              : 7163cb43-3886-479d-9d35-06d198f6d7cd
ObjectCategory    : CN=ms-Exch-Address-Rewrite-Entry,CN=Schema,CN=Configuration,CN={457EE1D7-B7DB-4232-B725-11273EDECBE4}
ObjectClass       : {top, msExchAddressRewriteEntry}
WhenChanged       : 20/06/2016 17:10:16
WhenCreated       : 20/06/2016 15:33:35
WhenChangedUTC    : 20/06/2016 15:10:16
WhenCreatedUTC    : 20/06/2016 13:33:35
OrganizationId    :
OriginatingServer : localhost
IsValid           : True
ObjectState       : Unchanged

When I send an email from telnet or another smtp sender mail flows from edge server to microsoft smpt but no header rewriting occurs.
In c:\inetpub\mailroot\drop of Microsoft SMTP server I see the .eml with the header "From:" unchanged.

Any Ideas?

hi, i have Exchange 2013 CU8,   some days ago i notice that i receive mail from me@domain.com to me@domain.com,    i check and i create SPF Record and Configure Sender ID, but Email come again,

here is config of SenderID,   what can i Check, what can be reason?

i, also, saw this instruction

https://support.symantec.com/en_US/article.HOWTO124678.html

but cant find any answer, i disable Content Fultering and check from telnet,  mail Sent, outside of organization

no any error like this "550 5.7.1 Sender ID (PRA) Not Permitted"

how fix this issue?

Hello everybody,

one of our customers sent e-mails on a larger scale , the database contains old / invalid entries (hard bounces ).
This means that the server ends up regularly on a blacklist.
He asked us if there is a possibility to stop the e-mail to " known hard bounces ".
We're talking about 10k and more e- mail addresses.
Question therefore: is realized with a transport rule , this according to your experience?

How big is the space for transport rules in Exchange 2013?

Alternatively a smtp proxy before Exchange would also be possible.
Does anybody knows a reasonable product?

Thanks

I cannot seem to find a way to get SMTP working with my ISP who just a few days ago decided to block port 25 and claim they are not blocking any ports.  I have replaced every piece of equipment (modem, router, switches, etc.) as tests and I cannot telnet on port 25 to an outbound server, or telnet port 25 to my inbound server, but opening port 26 and also port forwarding 26 to 25 internally works fine (both cases).  To get around this, I need to setup a connector and specify either ONLY TLS connection and not port 25 at all, or some other port entirely without TLS.  At this point I'd be happy to just get my email working again - even if it means using a VPN service to encrypt the port 25 traffic (which does work, but not ideal!)

Thanks in advance!