Recommended Security Best Practices for Helo

create share 646 Reputation points
2020-12-19T01:33:26.953+00:00

Hi,

What is the security best practice to provide for helo response and external NDRs in Exchange 2013? Should it show the server name or mx record only?

Thanks.

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,350 questions

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 141.6K Reputation points MVP
    2020-12-22T13:25:52.09+00:00

    See if this works for you:
    https://learn.microsoft.com/en-us/powershell/module/exchange/set-remotedomain?view=exchange-ps 

    Get-RemoteDomain | Set-RemoteDomain -NDRDiagnosticInfoEnabled $false

    -NDRDiagnosticInfoEnabled
    This parameter is available only in on-premises Exchange.

    The NDRDiagnosticInfoEnabled parameter specifies whether diagnostic information is included in non-delivery reports (also known NDRs or bounce messages) that are sent to recipients the remote domain. Valid values are:

    $true: The diagnostic information of an NDR includes details that help administrators troubleshoot delivery problems. This detailed information includes internal server names. This is the default value.
    $false: The diagnostic information section in the NDR body as well as internal server headers from the attached original message headers are removed from the NDR.
    This parameter is meaningful only when the value of the NDREnabled parameter is $true.

    1 person found this answer helpful.
    0 comments
  2. Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor
    2020-12-21T02:55:59.807+00:00

    @create share
    Hi,

    To change the helo response to avoid showing the internal server name, you may need to configure the FQDN settings on your receive connector.
    Run the following command in EMS: 

    Set-ReceiveConnector "Default Frontend <>" -FQDN <>

    Or you can do it in EAC:
    49882-33.png

    And to prevent NDR attack,you may need to enable the sender filtering.
    Here are the documents on this topic for your reference:
    Using the Sender Filter agent to block messages
    Manage sender filtering

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments
  3. create share 646 Reputation points
    2020-12-21T23:16:05.43+00:00

    Hi,

    I am getting the below error while changing the response.

    50181-default-frontend-receiver-connector.png

  4. create share 646 Reputation points
    2020-12-22T12:45:23.727+00:00

    I don't want to disable the NDRs but it is still showing the Internal Server Name in NDR even after changing the FQDN for Helo. I changed only for the Default Frontend connector.

    0 comments