Block anonymous SMTP telnet from internet

Tomass Pētersons 336 Reputation points
2022-09-11T22:28:22.71+00:00

Hi,

One of the clients uses Exchange hybrid with Exchange Server 2016. All mailboxes are in the cloud. Exchange Server 2016 basically runs in the default configuration. Only an additional anonymous relay has been created to allow a couple of local and few external IP addresses to send anonymous mail.

But recently we found out that anyone from the internet can connect to port 25 via telnet and send anonymous mail to our only accepted domain. Mail cannot be sent to unaccepted domain. We have SPF, DKIM, and DMARC configured for our domain, but these anonymous emails still gets through. After examining one of the mails we received, we found that the client_hostname shows the name of our Exchange server, but the original_client_ip shows the original IP address from which the connection to port 25 was made.

How can we deny these anonymous connections from the internet to port 25, but continue to allow from those IP addresses specified in the anonymous relay connector? Our domain MX records points to Microsoft servers.

Thanks!

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,357 questions
0 comments
Accepted answer
  1. Andy David - MVP 142.2K Reputation points MVP
    2022-09-11T22:38:08.79+00:00

    Use a transport rule and drop all messages from external users unless they come from the External IPs you allow

    239825-image.png

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. ATFRMZ 41 Reputation points
    2023-01-25T06:31:13.3533333+00:00

    I have similar issue our users are 50% o365 and 50% on-prem in hybrid setup with exchange 2016+edge server. pentesting guys found out that they can send emails via telnet our public ip. Shall i follow same steps to block it?