If you get time can you please add a basic list/table of contents using time markers simiar to our existing videos? You can look at some of the existing videos to get an idea. Let me know if you have any questions! It is slightly blurry but I can make it out , if this is a major issue for others we can see about fixing it using the conversion process.
It should be noted that the example allowspoof.com entered into the sendergroup would not be valid, as the sendergroup is a list of hostnames or IP addresses, not envelope domains. A valid entry would be something like smtp.allowspoof.com where smtp is the hostname of a sending device in the allowspoof.com root domain.
That's true, but you'll virtually never encounter an MTA that uses the root domain as its hostname. I only point it out because we frequently see user admins entering lots of domains in sendergroups falsely thinking that it will match a given sender and then wondering why the IronPort malfunctioned.
I'm not sure what part of this video broke it, but when following this, immediately all external mail was bounced back from our exchange server. The following organization rejected your message: mail.ourdomain.com.
I immediately undid everything explained in this video and mail was fixed. I am not sure how we can block spoofed email if it prevents us from emailing!
Attached PDF showing how to configure. Make sure that your RelayList is tied to a Relay policy and should be the first in your list and your internal mail servers should be hitting that HAT entry.
Thank you for that document, that helps. Although I am tempted to go ahead and try it again, I think I will wait until a slower time of day when any mishaps would go unnoticed.
I'm not sure what steps in that video broke outgoing mailflow, but the only thing that I did not follow was when I created the ALLOWSPOOF in the HAT overview, I did not change the order. It just went to the bottom of the list, in my case # 7 in the list. I can see on page 4 of this document ALLOWSPOOF is directly above WHITELIST in the HAT overview.
The only other difference we have is on page 4 your listener is called IncomingMail. My listener is called AllMail (and the DMZ IP Address:25 of the IronPort).
I think its because we have one public listener that is called AllMail? Perhaps putting the block from our domain names would have to be done only on a public listener and then we would use another interface on a private listener that we would repoint exchange to?
My guide and video uses a single listener for all mail. What matters is what HAT policy you hit, when you send email you should be hitting the Relay MFP action tied to a policy. This policy should be first in the list and the Relay policy should not be checking the Sender Verification Exception list. You are not spoofing your own domain you are simply sending. When mail comes inbound it should never hit the Relay MFP hence it should hit one of the other HAT entries that do check the Sender Verification Exception list.
3. except for the SenderGroup you want to allow to spoof your domain. Thanks for assisting.
Getting Started
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:
