This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(140.8, 90%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAK%3C/text%3E%3C/svg%3E)
Best,
I have restricted access for three distribution lists to specific distribution lists, mail, and security groups. This configuration has worked perfectly until I received a report about 2-3 months later indicating that someone without rights was still able to send an email. I checked the settings and found no errors. Two of the groups allow access to everyone, while the third one does not, which means the third one is functioning correctly. All three have the same settings and were created in the same period.
For the group that is not functioning correctly, I have taken the following steps:
After 30 minutes, I tested again, but the problem persists.
Do you have any suggestions or a solution for this issue?
Kind regards,
Laith
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(70.4, 18%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENM%3C/text%3E%3C/svg%3E)
Hi @Al Khazragy Laith ,
Thank you for posting to Microsoft Community.
Based on your description, I want to confirm if you mean you have restricted only three distribution lists can access the specific distribution lists and groups in your organization.
However, you find the user is not in the three distribution lists you've set up also could send emails to the specific distribution lists.
To make your issue clear, could you kindly explain “Two of the groups allow access to everyone, while the third one does not, which means the third one is functioning correctly.”
And please kindly share the configurations screenshot of the restrict you set up for the further investigation.
Also, please run a message trace to see what the email has gone through which could help you find out the step problem occurs.
Review if there are any other group or user permissions that might have been inadvertently granted which can override the restriction.
Looking forward to your update.
"Based on your description, I want to confirm if you mean you have restricted only three distribution lists that can access the specific distribution lists and groups in your organization."
Yes, I confirm. I have other distribution groups, but those three should be limited to several users, shared mail, and groups.
"However, you find that a user who is not in the three distribution lists you've set up can also send emails to the specific distribution lists."
Yes, indeed.
To make your issue clear, could you kindly explain, “Two of the groups allow access to everyone, while the third one does not, which means the third one is functioning correctly.”
So, I made the settings for all three together. They worked perfectly until I got the question of why everyone can send an email to two distribution groups. So, I tested and I see that two groups have this issue but one of the three is still working.
And please kindly share the configuration screenshots of the restrictions you set up for further investigation.
$autho = Get-DistributionGroup "DL Name" | Select-Object -ExpandProperty AcceptMessagesOnlyFrom
$autho | ForEach-Object { Get-Recipient $_ } | Select-Object -ExpandProperty Name
Output:
"Also, please run a message trace to see what the email has gone through which could help you find out where the problem occurs."
I will do that, but nice to know that the other distribution group that works correctly has the same accepted users who can send/mails/grpoups an email, so I don't think it conflicts with other groups. Also, the exception has been working until about one week ago.
Looking forward to your update.
If you need further help, please feel free to reply to this post directly so we will be notified to follow it up.
Just checking in to see if above information was helpful. Please let us know if you would like further assistance.
Hi,
Based on your description, I understand you have set the three DLs AcceptMessagesOnlyFrom several users, shared mail, and groups as output shows.
However, two of the DLs can still receive messages from others not in the output list above.
Please check if there are any transport rules might be allowing messages to bypass the restrictions.
And please kindly track the message that wasn't supposed to be delivered and review each of these steps to find out why sender not accepted is able to send messages to the DL.
Best,
After a thorough review and testing, I found a conflict with one of the security groups. A security group was mistakenly configured to include a distribution group.
Since this is a new environment for me, I attempted to resolve the issue. I believe it would be better to use security groups for access control instead of distribution groups. In my opinion, distribution groups should only be used to distribute news or general notifications, and not for access control.
@Noah Ma-MSFT Thank you for your help; it was very useful.
Hi @Al Khazragy Laith ,
I am so glad to know you have found the cause of the issue and happy to know my answer has been helpful to you. Please mark it as the answer since it could help other members of the Microsoft Q&A community who have similar questions and are looking for solutions. Thank you for your support and understanding.