Distribution Groups - Allow internal and 1 external email address

Question

Distribution Groups - Allow internal and 1 external email address

CaedenV 31

I would not think this would be too unique of a situation, but we have an internal distribution group that we want internal users to be able to send to. We also have an external service that sends reports and we would like that to be able to send to the group as well... but we don't want to open the group up to the whole awful that is the Internet.

Under Delivery Management on the distribution group I see where I can add an account or contact, but this then blocks everyone on the inside (as the description says it will). Also in my testing, adding a contact with an external email address does not work either. If I open it up to internal and external with no limits it works as expected, just trying to not do that if at all possible.
Also, any "Best Practices" to follow on this?

Thanks!

Tony Hewlett 11 Reputation points

2022-10-31T15:47:00.743+00:00

I get an error message stating the sendto rule can not be applied to a distribution list.... so close yet no dice...
Tony Hewlett 11 Reputation points

2022-10-31T17:04:47.877+00:00

In fact the only way I seem to be able to do this is to have a shared mailbox with the same rule as above applied to the shared MB. The MB it set to forward to the DL and not keep the original email, just to keep it cleaner.
`
Dale Holtzhausen 5 Reputation points

2023-06-14T10:21:17.1766667+00:00

Hi Tony,

Correct, you cannot add a DL to the recipient field. To bypass this and achieve the same result, please change "The recipient" to "The message" and then select "To or Cc box contains this person" and then you can select the DL email address.
Josef Meile 5 Reputation points

2023-08-23T15:42:18.5466667+00:00

This is only part of the solution. It won't work if somebody uses the BCC field. How do you block this? I tried to include my list email under: "Any recipient..." -> "address includes any of these words". But it seems that the BCC field isn't stored under the message headers, so it won't work.

For me it would be easier if Microsoft just includes the option to whitelist the domains when creating the distribution list. For me, this looks like a workaround that works under certain conditions
Dale Holtzhausen 5 Reputation points

2023-08-24T07:52:40.5+00:00

Hi Josef,

That is incorrect. We tested the solution using the BCC field and the email was delivered without fail.
Josef Meile 5 Reputation points

2023-12-06T12:39:46.5333333+00:00

Hi Dale

Sorry for my late reply. I didn't elaborate here much. I meant, everybody using the BCC will able to send to that distribution list, so, a spammer can take advantage of this because he will be only blocked if he uses the TO and CC, but not BCC.

Unfortunately there isn't any apparent solution of filtering the BCC too. It seems, as I said, that the BCC is not accessible at the mail server.
Jonathan Pollard 0 Reputation points

2024-01-17T11:51:50.15+00:00

I have this same situation. Previously, a few short months ago, I could do this with a transport rule or by using a 3rd party email filtering tool such as App River. However, Microsoft has hosed us yet again on this. If you have an answer that works, please reply.
Zoltan Erszenyi 1 Reputation point

2024-07-11T15:03:22.0766667+00:00
Hey Everyone, I am late to the party, but hope you (or someone else who reads it) might find it helpful.

Emails with a BCC recipient will have the Bcc header with a value of the email address of the BCC'd recipient:

You can try to create two rules:

One as highlighted above and which captures To and CC recipients.

Another rule with the same To and CC condition but with an additional condition that checks for the Bcc header and the distribution group's email address as its value:

You'll need the two rules which will work independent of each-other because there seems to be no way to set up an "A or (A and B)" type logic in one single rule.

I did not test it but it looks to me as it should work.

Good luck!

Accepted answer

1 additional answer

Your answer

Tony Hewlett 11 Reputation points

2022-10-31T15:47:00.743+00:00

I get an error message stating the sendto rule can not be applied to a distribution list.... so close yet no dice...
Tony Hewlett 11 Reputation points

2022-10-31T17:04:47.877+00:00

In fact the only way I seem to be able to do this is to have a shared mailbox with the same rule as above applied to the shared MB. The MB it set to forward to the DL and not keep the original email, just to keep it cleaner.
`
Dale Holtzhausen 5 Reputation points

2023-06-14T10:21:17.1766667+00:00

Hi Tony,

Correct, you cannot add a DL to the recipient field. To bypass this and achieve the same result, please change "The recipient" to "The message" and then select "To or Cc box contains this person" and then you can select the DL email address.
Josef Meile 5 Reputation points

2023-08-23T15:42:18.5466667+00:00

This is only part of the solution. It won't work if somebody uses the BCC field. How do you block this? I tried to include my list email under: "Any recipient..." -> "address includes any of these words". But it seems that the BCC field isn't stored under the message headers, so it won't work.

For me it would be easier if Microsoft just includes the option to whitelist the domains when creating the distribution list. For me, this looks like a workaround that works under certain conditions
Dale Holtzhausen 5 Reputation points

2023-08-24T07:52:40.5+00:00

Hi Josef,

That is incorrect. We tested the solution using the BCC field and the email was delivered without fail.
Josef Meile 5 Reputation points

2023-12-06T12:39:46.5333333+00:00

Hi Dale

Sorry for my late reply. I didn't elaborate here much. I meant, everybody using the BCC will able to send to that distribution list, so, a spammer can take advantage of this because he will be only blocked if he uses the TO and CC, but not BCC.

Unfortunately there isn't any apparent solution of filtering the BCC too. It seems, as I said, that the BCC is not accessible at the mail server.
Jonathan Pollard 0 Reputation points

2024-01-17T11:51:50.15+00:00

I have this same situation. Previously, a few short months ago, I could do this with a transport rule or by using a 3rd party email filtering tool such as App River. However, Microsoft has hosed us yet again on this. If you have an answer that works, please reply.
Zoltan Erszenyi 1 Reputation point

2024-07-11T15:03:22.0766667+00:00

Hey Everyone, I am late to the party, but hope you (or someone else who reads it) might find it helpful.

Emails with a BCC recipient will have the Bcc header with a value of the email address of the BCC'd recipient:

You can try to create two rules:

One as highlighted above and which captures To and CC recipients.

Another rule with the same To and CC condition but with an additional condition that checks for the Bcc header and the distribution group's email address as its value:

You'll need the two rules which will work independent of each-other because there seems to be no way to set up an "A or (A and B)" type logic in one single rule.

I did not test it but it looks to me as it should work.

Good luck!

Answer 1

Andy David - MVP 157.8K MVP Volunteer Moderator

Use transport rule instead:

Set the group to allow external senders, then create a rule that drops anything from Outside except from that sender sent to the Email Address of that DL:

It would look like this:

CaedenV 31 Reputation points

2021-09-21T19:00:49.297+00:00

That looks like it will work perfectly. I was hoping to have the controls on the account itself, but that makes enough sense to me.

Thank you!

Answer 2

Nezar Mohsen Sheikh Ahmed 0

use the Message property with the "To or Cc Contains this Person" and put your DL email.

Dale Holtzhausen 5 Reputation points

2024-05-14T07:40:28.8+00:00

BCC will bypass this as explained above in the comment section.
BigSecure 0 Reputation points

2025-06-02T16:50:30.72+00:00

Also wanted to add that if any external sender also emails and erroneously includes the DL address it will reject for all recipients, not just the DL group.

The weirdness of this whole system really stems from distribution lists being decomposed into a list of humans during delivery which is why you can't use the "recipient address" field- it's not a recipient, just a bunch of people.
Dale Holtzhausen 5 Reputation points

2025-06-03T08:22:16.88+00:00

@BigSecure I'd like to test that, but it does make sense. Hopefully, anybody who isn't supposed to email the DL doesn't know of its email address ;)

Share via

Distribution Groups - Allow internal and 1 external email address

1 additional answer

Your answer