Allow a Server to “Relay” Through Microsoft Exchange

KB ID 0000542

Problem

Back in the early days of email, just about all mail servers let you relay mail though them. That was fine until someone worked out you could then get someone else to send out your “spam”, and they would look like the guilty party. Even today people misconfigure their Exchange servers and make them an open relay.

But what happens if you have a particular server or machine that you want to let use your Exchange server as a relay? e.g. a Linux server that sends mail, or a SQL server running SQLMail? Then you need to allow relaying from either that IP address, or the network it’s on.

Allow Relay from an IP with Office 365 (Exchange Online)

Allow Relay from an IP with Exchange 2016 & 2013

Allow Relay from an IP with Exchange 2010

Allow Relay from an IP with Exchange 2007

Allow Relay from an IP with Exchange 2003

Allow Relay from an IP with Exchange 2000

Solution

Allow Relay from an IP with Exchange 2010 and 2007

1.From the Exchange Management Console > Server Configuration > Hub Transport > New Receive Connector.

allow relay 2010

2. Give the connector a name and select Custom > Next.

receive connector

3. Next.

new receive connector

4. Add > Add in the IP address(s) or network you want to allow relay from > OK.

relay exchange

5. Select the 0.0.0.0 255.255.255.255 entry and click DELETE.

Warning: Leaving this entry in will make your Exchange Server an Open Relay. (Note: This does NOT mean that your default connector is an “Open Relay” as this uses “authentication”

open relay

6. Next.

ip relay exchange

7. New.

exchange new connector

8. Finish.

allow relay 2010

9. Select your new connector then right click > Properties.

edit echange connector

10. On the Permission Groups tab ensure “Exchange Servers” is selected.

permission groups

11. On the Authentication Tab > Tick “Externally Secured (for example with IPSEC).” > Apply > OK.

externally secured ipsec

Allow Relay from an IP with Powershell

The following Powershell does the same as above;

New-ReceiveConnector -Name “Server2 Allow Relay” -usage Custom -Bindings ’0.0.0.0:25′ -RemoteIPRanges 172.16.254.207 -server DC2A – -permissiongroups ExchangeServers -AuthMechanism ‘TLS, ExternalAuthoritative’

Allow Relay from an IP with Exchange 2003 and 2000

1. Launch Exchange System Manager > Administrative Groups > Administrative group Name > Servers > Servername > SMTP > Right click Default SMTP Virtual Server > Properties.

Note: If you can’t see administrative groups right click the top level (in this case “First Organization (Exchange)) and tick the box to show administrative groups.

default smtp server

2. Access Tab > Authentication > Ensure “Anonymous Access” is enabled.

anonymous access smtp

3. Click Relay > Ensure the default of “Only the list below” is selected > Add.

allow relay 2003

4. Add in the IP addresses(s) networks or domains you want to allow ‘relaying’ from > OK.

allow ip to relay 2003

5. OK > Apply > OK.

exchange 2000 relay

 

Related Articles, References, Credits, or External Links

Exchange – Are you an Open Relay?

Author: Migrated

Share This Post On