This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 2%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPT%3C/text%3E%3C/svg%3E)
Dear MS Team
Currently, my organization is using your service with Microsoft 365 Business Premium. Recently days I have been having an issue in the Hybrid Exchange environment. My organization often receives spam emails due to the postmaster's address often sending emails out to strange recipients.
Let me describe the Hybrid Exchange model that the organization is using:
We are using Exchange Server 2013 for On-premise and then configuring the Hybrid with Exchange Online, all emails are routed to Exchange Online from Exchange Server 2013.
Currently, we have 2 postmaster addresses on 2 environments (On-premise & Online). I also have a Mail Flow Rule under the name “Block External Sending”.
That means that all our employees are only sending outside emails to specific recipients. If they send outside that is not on the list configured in the rule, the postmaster address will send Non-Delivery-Report back to the administrator.
The problem here is that when I track logs of emails on Exchange Server 2013, I see the postmaster address on-premise sending outside with strange domain names. Therefore, it was blocked by “Block External Sending” rule from Exchange Online and then Exchange Online's postmaster address sent a Non-Delivery-Report back to the administrator's email.
xxxx
Someone can help analyze the Exchange on-premise log and tell me where the cause started
Thank in advanced
Parker
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 35%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EXQ%3C/text%3E%3C/svg%3E)
Hi, Parker Tran
As you described, are you trying to resolve the question that postmaster address sends external emails with strange domain names?
Are the strange domain you are referring is specially on sales01@bpinpayg.com?
Could you please provide me more information with logs in emails with command get-messagetrackinglog?
Based on my personal search, check Open Relay to make sure your Exchange server is not configured as Open Relay.
A mail server that is accidentally or intentionally configured as an open relay masks the original origin of the message.
Hi @Xintao Qiao-MSFT > Are the strange domain you are referring is specially on sales01@bpinpayg.com?
Yes, and a lot of other strange emails
Could you please provide me more information with logs in emails with command get-messagetrackinglog?
Thank in advanced
Parker
Hi, Parker Tran
Based on your description, this issue looks like an Open Relay. You could check if the Exchange server is configured as an Open Relay or not.
You can use the command Get-ReceiveConnector | fl name, permissiongroups to check if the server is configured for open relaying
This will list the names and permission groups of all receiving connectors. If the PermissionGroups property contains AnonymousUsers, this indicates that the connector may be configured for open relay. More information please check Get-ReceiveConnector (ExchangePowerShell) | Microsoft Learn
Just circling back to check to see how things are going on with this thread. Should you need more help on this, you can feel free to post back.
Hi
I followed your instructions and discovered that my system had an Open Replay connection to allow the anonymous, so I disabled it. But today it happened again.
I checked the time frame that I received the NDR from the Exchange Online postmaster address
I monitor emails under Exchange-2013 looking up the event of all sent emails but only see the event that the postmaster under on-premise sends out to strange domains (this means something happened in the on-premise email system, and after the postmaster address on-premise already to send NDR)
When I checked all the emails received at that time on Exchange 2013, I found a strange point because when an email is received, it must go through the Received Connector (HealthMailbox14d9256226ef4116a6300d2fdb242bb3), but there are a few emails sent (sending and receiving emails are strange emails) it does not go through the Received Connector
Thank you!
Hi, Parker Tran
Based on your description, I understand that you are in a hybrid environment and are working well in Exchange Online. If you do not have a feature requirement for your on-premises environment, it is recommended that you migrate on-premises environment to Exchange online.
In addition, since Microsoft has discontinued support for Exchange 2013 on April 11, 2023, this may cause some unknown issues, so it is recommended that you update to the latest version to reduce spam attacks. More information can be found Exchange Server 2013 end of support roadmap - Exchange | Microsoft Learn