Exchange Server Cookbook

7.19. Controlling Mail Relaying

Problem

You need to configure which systems are allowed to relay mail through your Exchange server.

Solution

Using a graphical user interface

You can control relay access at the virtual server level or at the SMTP connector level. This is how you do it at the virtual server:

1. Open the Exchange System Manager (Exchange System Manager.msc).

2. Expand the organization→ Administrative Groups→ target administrative group→ Servers→ target server→ Protocols→ SMTP.

3. Right-click the desired virtual server and click Properties. Click the Access tab. Click Relay.

4. Unless you need to permit authenticated SMTP users to relay through your server, uncheck the Allow all computers which successfully authenticate to relay, regardless of the list above checkbox. Leaving this checked can provide an avenue for stealth relay and password-discovery attacks.

5. If you wish to restrict a small group of computers from relaying through your virtual server (this is usually only suitable for a server on your internal network), select All except the list below. Otherwise, select Only the list below to permit relay only to the systems listed.

6. Click the Add button and add a single IP address, a group of IP addresses, or a domain name. Click OK.

7. When you have the correct entries in the list, click OK.

Here is how you control relay access at the SMTP connector:

1. Open the Exchange System Manager.

2. Expand the organization, Administrative Group, administrative group, Routing Groups, routing group, and Connectors ...