Windows EventLog 1035 --> Default Frontend MailServer

Question

Hello.
In my small company we use single Exchange 2016 CU23 Server [>100 users].
Since some days I'm facing with receive many errors in Windows EventLog 1035 from Default Frontend
MailServer:

After check many Exchange logs I found some interesting part in FrontendTransport --> SmtpReceive logs when this log in WinEventLog is registred in the same time. Part of this exchange log is here:
277412-default-frontend-log.txt
My all receive connectors are:

Security of my Default Frontend MailServer looks like this:

So my main questions for this topic are:

1. Can this somehow avoided with better config of Default Frontend receive connector?
2. Or rather is an security issue and communication need to be better protect for example on external firewall?

Answer 1

Hi @MikeZetPL

Can this somehow avoided with better config of Default Frontend receive connector?

It is not recommended to modify the settings of the five default receive connectors (including the Default Frontend receive connector).
I would suggest just leave it as the default setting to avoid issues.

Or rather is an security issue and communication need to be better protect for example on external firewall?

To me this may seem like probes or script attacks.
If you have found a large amount of suspicious requests from some specific ip addresses, please consider blocking these ip addresses on your firewall.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.