Is your Exchange Server relaying spam? How to Prevent annoying spam coming from your own domain

Overview:

One of the more annoying types of spam is the one that seems to be coming from your own domain; or worse— from your own email address! Of course, users from your own domain don’t generally spam each other— unless you’re using one of the free web-based email services. And most of us don’t spam ourselves.

Obviously, this is coming from a spammer who has spoofed your email address, or that of someone else from your domain. Unfortunately, the protocol that allows mail clients and servers to exchange email, allows headers to be spoofed easily.

Example of spam message;

Here is an example of spam invasion with blank sender id and unknown source ip address.

Identity: ExchangeServer\457246\2113836
Subject: Undeliverable: Puerto Rico employment law essentials
Internet Message ID: <fd3fc050-6cb4-4d7e-8f37-decd7f191d54>
From Address: <>
Status: Ready
Size (KB): 23
Message Source Name: DSN
Source IP: 255.255.255.255
SCL: -1
Date Received: 7/27/2011 8:19:23 AM
Expiration Time: 7/29/2011 8:19:23 AM
Last Error: 400 4.4.7 Message delayed
Queue ID: server-ex\457246
Recipients: bounce-219841-1586557@list3.randomdomain.com

1. First you need to find out whether the Exchange Server is an open SMTP relay.

"An open mail relay is an SMTP server configured in such a way that it allows anyone on the Internet to send e-mail through it, not just mail destined to or originating from known users. Such servers are usually targets for spam senders."

Note: For how to determine if your Exchange Server is an Open relay see the following link

https://support.microsoft.com/en-us/help/324958/how-to-block-open-smtp-relaying-and-clean-up-exchange-server-smtp-queues-in-windows-small-business-server

If you have an open mail relay, I suggest you remove permission to bypass the sender address spoofing check by running:

Get-ReceiveConnector "name of the internet receive connector" | Get-ADPermission -user "NT AUTHORITY\Anonymous Logon" | where {$_.ExtendedRights -like "ms-exch-smtp-accept-authoritative-domain-sender"} | Remove-ADPermission

To block the "Blank Sender" as you can see in the above snapshot do the following;

Set-SenderFilterConfig -BlankSenderBlockingEnabled $ true

If someone out of your domain pretend to send email as your own domain users, to prevent it, please use the following command to remove ms-Exch-SMTP-Accept-Any-Sender for anonymous users with:

Get-ReceiveConnector "name of the internet receive connector" | Get-ADPermission -user "NT AUTHORITY\Anonymous Logon" | where {$_.ExtendedRights -like "ms-Exch-SMTP-Accept-Any-Sender"} | Remove-ADPermission

*Make sure to restart transport service after those operations

If the above mentioned method doesn't work then try the following;

1- Get-RecipientFilterConfig | Format-List Enabled

2- Set-RecipientFilterConfig -BlockListEnabled $true

3- Get-RecipientFilterConfig | Format-List BlockListEnabled

4- Set-RecipientFilterConfig -RecipientValidationEnabled $true

5- Get-RecipientFilterConfig | Format-List RecipientValidationEnabled

6- Set-SenderReputationConfig -Enabled $true

7- Get-senderreputationconfig | fl *mail*

8- set-senderreputationconfig  -InternalMailEnabled $true

9- Get-senderreputationconfig | fl *mail*

Moreover you can use Wireshark to Monitor your SMTP traffic closely to find out the infected clients.

Try these filters:

tcp.port==25

smtp.data.fragment.count > 0 and not (imf.address contains "yourcompany.com")

Hope you will find this helpful.