How to block outside email addressing from the Exchange Server

[sekermestrovich]

Quite a bit of users are receiving outside email from email addresses that have viruses attached. Although Trend Micro is deleting the virus attachments, I would like to block certain email addresses from going past the Exchange server. (This is Exchange 5.5 running on Windows NT.)

Can this be done?

 

[rickyj99]

From Exchange Admin if you go to Configuration, Connections, Internet Mail Service. Click on the Connections tab. You'll see a button called "message filtering" click on that and then add in the email address(es) you wish to block. Apply the change. You'll need to stop and restart the IMS for the changes to take place.

 

[sekermestrovich]

Thanks for the tip Rickyj99, but after entering the addresses to block and stop/starting the MIS service, they still continued to come through. Any other suggestions?

 

[Dyadmin]

use the @ sign. For instance if you want to block the whole domain from emailing you, type in @banthisdomain.com just that with nothing before the @ sign.

 

[sekermestrovich]

I don't want to block the entire domain, only one address from the domain. Can this be done?

 

[Dyadmin]

Then use the same principle, Idontwantmailfromyou@fromthisdomain.com, you will only block from that user, just like Ricky99 said. However, they may be using an alias, turn on message logging and as soon as that message comes in check out your IMCDATA\IN folder and match the date and the time, usually it's a minute earlier, sometimes not.

 

[coffeejunkie]

Here is an small example of how to keep a list updated and paste into your registry's Turf table.

NOTE ONLY : Adjust list as needed. Then copy and paste this list excluding this note into servers turf table. Open Regedt32 , HKLM\Currrentcontrolset\services\msexchangeimc\parameters then open turftable key.
.
@123go.net
@123india.com
@1-500-fingers.com
@1cust78.tnt13.sfo3.da.uu.net
@1floodgate.com
@1stamend.com
@1stfamily.com
@1stpress.com
alamo@hk.net
alar14@mail.ee
aletavilar931@excite.com
alf6955@pacbell.net
alfa034@hotmail.com

This can be a labor intensive task, that may overwhelm you, but keep at it.

coffee

 

[sekermestrovich]

Thanks for all your help, however the emails are still flowing in. I've added all the addresses to the message filtering within IMS and checked the registry where they are showing, but the emails are still coming.

 

[Grenage]

Just for fun, have you tried stopping and starting the Internet Mail Service ?

 

[sekermestrovich]

Yes, a few times.

 

[Grenage]

Okay, can you add a known working email account you have external to the company to the ignore list? Then send a message from that account to see if you receive it or not.

 

[irfanafzaldotcom]

Hi,

Were you able to solve the problem with Exchange? Iam facing a similiar problem and I was wondering if you have a solution you could share with me and the rest of us here.

Thanks and with kind regards
Irfan

 

[PBurcin]

See the post in this forum titled "Tons of IMS queued messages with no originator -- spam?" Many great tips on how-to determine where the spam is coming from and even better tips on how-to lock down your IMC.