Exchange 2010: Default settings for the receive connectors

Today, for the first time in a long time, I came across an Exchange server that was configured as an open relay. I actually thought that such configuration errors were a thing of the past. Apparently, however, some people are still making this nasty mistake, so here are the default settings of the receive connectors so that the settings can be corrected.

By default, there are 2 connectors with the names "Default SERVERNAME" and "Client SERVERNAME". The default connector is responsible for all mail traffic from the Internet to the Exchange Server

The default connector has therefore entered all IPv4 and all IPv6 addresses as remote servers:

Here are the authentication methods in the default setting

And here are the authorization groups

Only on the default connector is the "Anonymous users" box checked, mail servers from the Internet will not authenticate themselves to Exchange Server if they want to get rid of a mail.

The second receive connector is the client connector, which is responsible for the users' mail traffic to the Exchange Server.

The Client Connector does not listen on port 25 but on port 587. Here too, all IPv4 and IPv6 addresses are permitted in the standard setting; this can be restricted to the local subnets if desired

Here are the authentication methods

And here are the authorization groups for which only "Exchange user" is selected.

And now the nasty trap: the "Accept-Any-Recipient" right must not be assigned to anonymous users on the default connectors. This can be checked with the shell:

Get-ADPermission "Default SMAIL01" -user "NT-AUTHORITY\ANONYMOUS-ANMELDUNG" | ft identity,user,extendedrights

The picture above shows the standard rights. The image below shows a connector on which anonymous relay is permitted:

So it's nice to see in the shell: "Accept-Any-Sender" and "Accept-Any-Recipient". This is a very bad idea if you don't want to end up on a blacklist.

However, some applications require a way to relay their mails anonymously via Exchange. If you need this feature, you should create a separate connector and only allow anonymous relay for the one server with the application. I have described how to do this here:

https://www.frankysweb.de/?p=180