Recipient filtering is a feature in Exchange Server that relies on the RCPT TO SMTP header to determine what action to take on an inbound message. Recipient filtering is performed by the Recipient Filter agent, which is part of the Anti-Spam Agents package. These agents are enabled by default on Edge Transport servers, however you need to enable them manually on Exchange Mailbox servers. In this article, you will learn how to enable recipient filtering for Exchange Server.
Before you start
Ensure you have a third-party spam filter in your organization. The one I highly recommend is SpamBull. It’s powerful, reliable, and keeps your organization users’ inbox clean and secure.
Enable Recipient Filtering for Exchange Server
To enable recipient filtering in Exchange Server, follow the steps below:
- Start Exchange Management Shell as administrator.
- Get a list of all the transport agents installed on the Exchange Server.
Get-TransportAgentThe output appears.
Identity Enabled Priority
-------- ------- --------
Transport Rule Agent True 1
DLP Policy Agent True 2
Retention Policy Agent True 3
Supervisory Review Agent True 4
Malware Agent True 5
Text Messaging Routing Agent True 6
Text Messaging Delivery Agent True 7
System Probe Drop Smtp Agent True 8
System Probe Drop Routing Agent True 9- If the Recipient Filter Agent is listed and enabled, you can skip this step. If not, install it using the command below.
Note: When you run the script below, it will also install 4 other Anti-Spam agents. You must disable them, as shown in the next step. That’s because you already have a third-party spam filter set up, and you don’t want them to interfere with each other.
& $env:ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1- Enable the Recipient Filter Agent.
Enable-TransportAgent "Recipient Filter Agent"- Disable all other Anti-Spam Agents.
Disable-TransportAgent "Content Filter Agent" -Confirm:$false
Disable-TransportAgent "Sender Id Agent" -Confirm:$false
Disable-TransportAgent "Sender Filter Agent" -Confirm:$false
Disable-TransportAgent "Protocol Analysis Agent" -Confirm:$false- Verify if the 4 Anti-Spam Agents are disabled.
Get-TransportAgentThe output appears.
Identity Enabled Priority
-------- ------- --------
Transport Rule Agent True 1
DLP Policy Agent True 2
Retention Policy Agent True 3
Supervisory Review Agent True 4
Malware Agent True 5
Text Messaging Routing Agent True 6
Text Messaging Delivery Agent True 7
System Probe Drop Smtp Agent True 8
System Probe Drop Routing Agent True 9
Content Filter Agent False 10
Sender Id Agent False 11
Sender Filter Agent False 12
Recipient Filter Agent True 13
Protocol Analysis Agent False 14- Ensure your accepted domains are using Address Book to check for valid recipients. By default, this should be enabled when Exchange is an authoritative Mailbox Server for the domain.
Get-AcceptedDomain | Format-Table Name,AddressBookEnabledThe output appears.
Name AddressBookEnabled
---- ------------------
exoip.local True
exoip.com True- If the Address Book is enabled, you can skip this step. If it’s disabled, use the following command to enable.
Set-AcceptedDomain example.com -AddressBookEnabled $true- Enable recipient validation.
Set-RecipientFilterConfig -RecipientValidationEnabled $true- Get the receive connectors on the Exchange Server.
Get-ReceiveConnector | Format-Table Name, BindingsThe output appears.
Name Bindings
---- --------
Default EX01-2019 {0.0.0.0:2525, [::]:2525}
Client Proxy EX01-2019 {[::]:465, 0.0.0.0:465}
Default Frontend EX01-2019 {[::]:25, 0.0.0.0:25}
Outbound Proxy Frontend EX01-2019 {[::]:717, 0.0.0.0:717}
Client Frontend EX01-2019 {[::]:587, 0.0.0.0:587}- Write down the name of the connector with binding ending with :2525 (listening on connections from port 2525). This is most likely the Default receive connector.
- Set the receive connector to accept unauthenticated SMTP connections.
Set-ReceiveConnector -Identity "Default EX01-2019" -PermissionGroups "AnonymousUsers, ExchangeUsers, ExchangeServers, ExchangeLegacyServers"- Restart the Microsoft Exchange Transport service.
Restart-Service MSExchangeTransport- Open port 2525 on the firewall to the Exchange Server.
- Edit the route in the SpamBull spam filter (Domain Level Control Panel > Incoming > Destinations) to use port 2525 rather than port 25.
- Disable port 25 on the firewall to the Exchange Server.
- Send an email and verify that it’s successful.
That’s it!
Read more: ISP blocks SMTP port 25 – Bypass/Fix »
Conclusion
You learned how to enable recipient filtering for Exchange Server. It’s an excellent feature to set up, as it checks if incoming emails are sent to valid recipients on your Exchange server. This helps block emails sent to non-existent users. Remember to apply the steps to all the Exchange Servers.
Did you enjoy this article? You may also like Exchange SMTP high availability with Kemp load balancer. Don’t forget to follow us and share this article.