Knowledgebase

Enabling or disabling Sender filtering

You can use the Exchange Management Shell (EMS) to easily enable or disable Sender filtering. Remember, it is enabled by default. If you want to quickly disable it to see if Sender filtering is blocking a message, you can use the EMS command

Set-SenderFilterConfig -Enabled $false

To re-enable Sender filtering, enter the command

Set-SenderFilterConfig -Enabled $true

Checking Sender Filtering configuration

The easiest way to get a complete view of Sender filtering on your server is to open an EMS and run the following command.

Get-SenderFilterConfig | fl

You can see all the settings in one list using this command.

Configuring the Sender filtering action

Sender filtering can either block a message at the border responding to the MAIL FROM command with a “554 5.1.1 Sender Denied” message, delete it without sending back a 554, or it can stamp a message as being from a blocked sender and pass it on for further processing. Here, my advice is simple. If you are going to use Sender filtering, block the messages. It makes no sense to me to decide a sender is blocked, but then send the message on for further analysis. To set this action, you can use the Exchange Management Console and browse to Organization Configuration, Edge Transport, Anti-spam, Sender Filtering, and set the desired Action, but you will need to use the EMS to decide whether to send a 554 or silently delete. Here are the commands you can use to configure rejecting and either sending a 554(reject) or silently deleting (delete) at the EMS.

Set-senderfilterconfig –action reject –recipientblockedsenderaction <reject | delete>

Configuring or checking Blocked Senders

You can use the Exchange Management Console, or the Exchange Management Shell, to configure filtered (blocked) senders. You can specify individual addresses, domains, or domains and subdomains. Again, be careful how you use this. Configuring individual sender addresses is very precise, but sender addresses are also easily spoofed. Domains are an all or nothing approach, and domains and subdomains are too. If you need to block all but X, use a transport rule as mentioned above. You can use the EMS commands that follow to add senders, domains, or domains and subdomains to the blocked list.

Set-SenderFilterConfig -BlockedSenders joe@example.com, fred@example.net

Set-SenderFilterConfig -BlockedDomains example.com

Set-SenderFilterConfig -BlockedDomainsAndSubdomains example.com

Each time you enter one of the above commands, you overwrite the existing configuration. To remove an entry, simply re-enter all the entries you want to keep, minus the one you wish to remove (or break down and use the EMC since the GUI is easier to use!) Since these lists can get cumbersome, you can use the following to read the existing entries and append to the list if you insist on sticking with the command line.

$Configuration = Get-SenderFilterConfig $Configuration.BlockedSenders += joe@example.com $Configuration.BlockedDomains += “example.net” Set-SenderFilterConfig -BlockedSenders $Configuration.BlockedSenders -BlockedDomains $Configuration.BlockedDomains

Checking logs to see if Sender filtering is blocking an incoming email

You can easily check the logs to see if Sender filtering is blocking an incoming email. Use the EMS to enter this command to quickly parse the agent logs.

get-agentlog | where {$_.SmtpResponse -eq “554 5.1.0 Sender denied”}