Exchange 2019 TLD blocking

Question

Exchange 2019 TLD blocking

JoedyF222 41

Due to our email filter being useless since the company upgraded it I am trying to use the Exchange to block TLD

I have added a Sender Filter but it still allowed the emails to come through

SerializationData : {0, 1, 0, 0, 0, 255, 255, 255, 255, 1, 0, 0, 0, 0, 0, 0...}
RunspaceId : 26678392-58ad-440f-827a-1d6666ca257e
Name : SenderFilterConfig
BlockedSenders : {}
BlockedDomains : {}
BlockedDomainsAndSubdomains : {de, online, biz, club, xyz}
Action : Reject
BlankSenderBlockingEnabled : True
RecipientBlockedSenderAction : Reject
Enabled : True
ExternalMailEnabled : True
InternalMailEnabled : False
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
DistinguishedName : CN=SenderFilterConfig,CN=Message Hygiene,CN=Transport
Settings,CN=XXX,CN=Microsoft
Exchange,CN=Services,CN=Configuration,DC=XXX,DC=local
Identity : SenderFilterConfig
Guid : ezb3ce3c-6590-4c6e-b06e-1f95d38b84c4
ObjectCategory : XXX.local/Configuration/Schema/ms-Exch-Message-Hygiene-Sender-Filter-Config
ObjectClass : {top, msExchAgent, msExchMessageHygieneSenderFilterConfig}
WhenChanged : 2/05/2022 11:56:23 AM
WhenCreated : 21/11/2009 4:12:45 PM
WhenChangedUTC : 2/05/2022 1:56:23 AM
WhenCreatedUTC : 21/11/2009 5:12:45 AM
OrganizationId :
Id : SenderFilterConfig
OriginatingServer : XXXXXX.XXX.local
IsValid : True
ObjectState : Unchanged

Accepted answer

0 additional answers

Your answer

Answer 1

Kael Yao 37,746 Moderator

Hi @JoedyF222

I tested in my lab and it seems to work for me.

Have you restarted Microsoft Exchange Transport service after you modified the sender filter?

If it still doesn't work for you, you may also consider using mail flow rule instead.
The rule would be like:

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

JoedyF222 41 Reputation points

2022-05-03T09:23:50.483+00:00

was it the same settings as mine? yep restarted the transport services, will give the server a restart and see if that makes a difference and if not will test your answer.

Thanks for the response.
JoedyF222 41 Reputation points

2022-05-03T21:42:45.367+00:00

That made no difference, emails are still coming through from those TLD's

where can I check what it is actually doing to check those emails?
Kael Yao 37,746 Reputation points Moderator

2022-05-04T07:45:01.137+00:00

To check which mail flow rule is applied to an email, you may follow these steps:

1.Search message tracking log for the message and get the AgentInfo event
Below is an example of an email sent from TLD .de, blocked by the mail flow rule in former reply:

2.In the EventData field, you may see a rule ID and the corresponding action if the rule worked on this message (In this case the action is reject the message)

3.If you have multiple mail flow rules, you can find the rule by the rule ID

In this case, please have a check if the rule ID is pointed to the TLD rule, or it was some other mail flow rules which have a higher priority over the TLD rule.
JoedyF222 41 Reputation points

2022-05-04T08:20:54.743+00:00

Thank you for the reply very helpful.

so this is what I did and it has shown that I had the rule at a low priority so have changed that and will check tomorrow. Heaps easier when you know where to check.

![
JoedyF222 41 Reputation points

2022-05-05T23:49:53.2+00:00

I changed its priority and restarted the transport service but made no difference it is still letting them through, will restart the server tonight and then check to see if it is starting to block them.
Kael Yao 37,746 Reputation points Moderator

2022-05-06T09:29:56.037+00:00

Hi,

It seems the message didn't trigger the TLD rule.
Please post a screenshot of the rule.
JoedyF222 41 Reputation points

2022-05-06T21:56:29.317+00:00

the rule seems fine
Kael Yao 37,746 Reputation points Moderator

2022-05-09T06:12:18.153+00:00

Hi,
Your rule condition is apply this rule if the sender address includes ....
Which applies only when the sender email address contains the exact text pattern @*.xyz$, would the message be blocked.

Since the patterns (@.xyz$, @.online$) are actually regular expressions, you may need to use this condition the sender address matches any of these text patterns instead.
JoedyF222 41 Reputation points

2022-05-09T07:22:03.067+00:00

will try this one
Kael Yao 37,746 Reputation points Moderator

2022-05-12T02:52:03.6+00:00

Hi,
Just checking in to see how thing going now?
Does the rule work for you?
JoedyF222 41 Reputation points

2022-05-12T22:18:13.85+00:00

still not processing the rule as a priority it is the highest
Kael Yao 37,746 Reputation points Moderator

2022-05-13T09:04:23.207+00:00

Hi,
From the screenshot it seems the rule was triggered.
Did the sender still receive the email?

If using message tracking to track the whole mail flow process, would you see a DELIVER event? Or there is a FAIL event?
JoedyF222 41 Reputation points

2022-05-17T20:59:07.277+00:00

Thank you very much for your help, it has worked as required

Share via

Exchange 2019 TLD blocking

0 additional answers

Your answer