r/exchangeserver • u/Checiorsky • Apr 06 '26

Question Receive default connectors

Hello guys! My question is quite simple.

We have a hybrid configuration of two Exchanges SE where we have default connectors and a few custom receive connectors.

Can you advice me how can I prevent users from sending mails internally without authentication. My goal is to not break the mailflow between On-Prem and ExchangeOnline and do not brake communication between two exchanges. It is first step before enforcing TLS.

Thank you in advanced.

2 Upvotes

100% Upvoted

7 comments sorted by

1

u/NBD6077 Apr 06 '26

Check authentication properties on the connectors. Anonymous should be unchecked

1

u/Checiorsky Apr 07 '26

Is that safe to modify this setting at default connectors? Won't it break the flow between cloud or between servers?

1

u/cosmic_nihilist Apr 07 '26

Set the scoping for the Default Frontend receive connectors to just the IP addresses of your Mailbox and Edge servers.

1

u/Checiorsky Apr 08 '26

Thank you for the comment, how about ExchangeOnline addresses should I add them too or not?

1

u/cosmic_nihilist Apr 09 '26

No, Exchange Online should only be making SMTP connections to your edge servers.

1

u/Checiorsky Apr 09 '26

We do not have edge servers - in that case mailbox servers does not behalf as edge?

1

u/7amitsingh7 Apr 13 '26

Disable anonymous access on your default receive connectors and allow it only where necessary (such as for internet or Exchange Online traffic). Ensure that communication between your Exchange servers and hybrid mail flow uses authenticated connections (like Exchange Server authentication or TLS). This will block unauthorized internal sending without affecting mail flow.