The ms-Exch-SMTP-Accept-Authoritative-Domain-Sender removal does not work

Question

Hi. I found that by default from my server (
Edge - 15.02.0721.002, Exchange Server 2019 CU7 ) I can send anonymous messages from any domain.

I found information that you can remove the permissions from the receive connector: ms-Exch-SMTP-Accept-Authoritative-Domain-Sender

Get-ReceiveConnector "Default internal receive connector RL-EDGE" | Get-ADPermission -user "NT AUTHORITY\Anonymous Logon" | where {$_.ExtendedRights -like "ms-exch-smtp-accept-authoritative-domain-sender"} | Remove-ADPermission  

But I can still put any domain in the from field and send myself an email.

Answer 1

See my previous answer:
https://learn.microsoft.com/en-us/answers/questions/203616/ms-exch-smtp-accept-authoritative-domain-sender-de.html

Answer 2

In latest Exchange versions, Receive Connector should be created as a 'Transport Service Role' to stop anonymous senders. As the port 25 is already bound to Frontend Transport role, a new Transport Service to be created with a different port binding as well. In general, the following approach will help:

1. Create a new Receive Connector: New-ReceiveConnector -Name <name> -TransportRole HubTransport -Custom -Bindings <LocalIPV4>: 2525 -RemoteIpRanges <RemoteIPV4>
   2- Grant anonymous permission to the new connector: Get-ReceiveConnector <name> | Add-ADPermission -User "NT AUTHORITY \ ANONYMOUS LOGON" -ExtendedRights "Ms-Exch-SMTP-Accept-Any-Recipient"
   3- Deny access to non-accepted domains: Get-ReceiveConnector <name> | Remove-ADPermission -User "NT AUTHORITY \ ANONYMOUS LOGON" -ExtendedRights "Ms-Exch-SMTP-Accept-Any-Sender"

Answer 3

The default <server name> receive connector has bindings on 2525, not port 25, nor would it have the TLSDomainCapabilities populated. That doesnt look right. Did you create that custom or change something?

A custom receive connector would be transport type "FrontEndTransport'

The default FrontEnd <Server> connector is type FrontEndTransport and listens on port 25.

Answer 4

Ok, I didnt see the original question was about Edge.
Wouldnt a rule make more sense here?

https://support.knowbe4.com/hc/en-us/articles/212679977-Domain-Spoof-Prevention-in-Exchange-2013-2016-Microsoft-365