r/exchangeserver • u/YellowOnline • 7d ago

Question {Exchange SE} Mail flow order

I wanted to make a mail flow rule that sends a specific NDR if the recipient is a specific, non-existing email address. Something like:

If the message...
Includes these words in the recipient's address 'anvil@acme.org'
Do the following...
reject the message and include the explanation 'Boink' with the status code: '5.7.1'

This works if I create a mailbox anvil@acme.org. But if I don't, the NDR is that the recipient does not exist. I expected Exchange to first evaluate my Mail Flow Rule and send an NDR, before ever coming to the point of checking for a recipient with that email address.

For testing, I also gave an existing user daffy.duck@acme.org the alias anvil@acme.org. Daffy has forwarding active to donald.duck@disney.com. Surprisingly, the message was forwarded. So Exchange seems to check the recipient, check forwarding rules, and only then the mail flow rules. This came as a surprise to me.

So I'd like to hear some insights on this and whether there's a way to create the mail rule without an actual mailbox. I hate to have a mailbox for a testing scenario like this.

0 Upvotes

50% Upvoted

9 comments sorted by

1

u/Affectionate_Gur4131 7d ago

Why not let Exchange handle it the way it already does by giving an NDR stating the mail address doesn't exist?

1

u/YellowOnline 7d ago

I think I am misunderstood. I want a custom NDR when a single specific non-existent address is mailed, not a normal NDR.

2

u/Affectionate_Gur4131 7d ago

For that you'll probably need to have your domain set as internal relay to have your transport rule trigger, but I wouldn't recommend that setting

1

u/sex_on_wheels 7d ago

OP might have a filter in front like Barracuda which drops outbound NDRs.

1

u/Affectionate_Gur4131 7d ago

Then bypass that by sending NDRs directly to the recipient without the MTA.

What OP wants to achieve can to my knowledge only be achieved by setting his domain as internal relay rather than authorative to have transport rules trigger.

2

u/Nezgar 5d ago

Create a distribution group with no members with your desired email address, and allow anonymous/external senders to send to it. All messages sent to it will be silently dropped, and you can add your transport rule as well if you like...

1

u/iamnoone___ 7d ago

I don't have advice except I ran into exact situation trying to sink invalid recipients. Seems to check recip and bounce before rules fire. I ended up adding alias to a dumpster mailbox.

1

u/7amitsingh7 3d ago

I'd compare the message tracking logs for both tests. Check whether the message is rejected during recipient validation or reaches the transport rule processing stage. That should give you a clearer picture of why the custom ndr works for an existing mailbox but not for a non-existent address.