High Amount of Spam on Exchange 2013 - Content Filtering is Enabled but Pfizer Spam Filling Up Everyone's Mailboxes

Hello
Previously I used Exchange 2010 with Forefront Threat Protection installed and this used to do a good job of stopping all the spam.
However since updating to Exchange 2013 earlier this year and enabling the integrated spam filtering everyone noticed a sudden increase in the amount of spam which was getting through which has been bad for a long time.
We have been living with it but in the last 3 weeks everyone has started getting about 40 emails a day from Pfizer for Viagra. All these seem to defeat the content filtering as Viagra is spelt with an extra I and the email address is always different.
Also images in emails are blocked by default but somehow all the images on these spam messages appear for everyone.
I am not sure the spam filtering is working at all and I'm not sure how to tell as ForeFront gives you a nice graphical dashboard but I can find nothing similar to this in Exchange and PowerShell seems the only way to configure the limited functionality
of the content filter.
Is there any way to get rid of these messages as it doesn't look very good when they are constantly popping up for everyone?
Thanks
Robin
Robin Wilson

Hello ManU
Thanks for the reply.
I have checked the logs and see this quite often:
AcceptMessage,,SCL,not available: policy is disabled
But other times it says this:
RejectMessage,550 5.7.1 Message rejected as spam by Content Filtering
Which seems to indicate it is rejecting some.
This is what one of the email headers look like:
Received: from RWS-MAIL.rwsservices.net (192.168.2.151) by
RWS-MAIL.rwsservices.net (192.168.2.151) with Microsoft SMTP Server (TLS) id
15.0.775.38 via Mailbox Transport; Sat, 28 Dec 2013 10:59:26 +0000
Received: from RWS-MAIL.rwsservices.net (192.168.2.151) by
rws-mail.rwsservices.net (192.168.2.151) with Microsoft SMTP Server (TLS) id
15.0.775.38; Sat, 28 Dec 2013 10:58:38 +0000
Received: from [90.169.106.204] (90.169.106.204) by mail.rwsservices.net
(192.168.2.151) with Microsoft SMTP Server id 15.0.775.38 via Frontend
Transport; Sat, 28 Dec 2013 10:58:37 +0000
Date: Sat, 28 Dec 2013 12:05:58 +0200
From: US.Pfizer eStore <[email protected]>
To: robin.wilson <[email protected]>
Message-ID: <[email protected]>
Subject: Dear robin.wilson up to 65% OFF!
X-Mailer: Airmail (223)
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="dd2ee3ea_586bb9e4_6f04"
Return-Path: [email protected]
X-MS-Exchange-Organization-PRD: 001-taxis.co.uk
X-MS-Exchange-Organization-SenderIdResult: Neutral
Received-SPF: Neutral (rws-mail.rwsservices.net: 90.169.106.204 is neither
permitted nor denied by domain of [email protected])
X-MS-Exchange-Organization-Network-Message-Id: e8825204-1f32-48be-a331-08d0d1d30209
X-MS-Exchange-Organization-SCL: 1
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-Antispam-Report: DV:3.3.13223.464;SID:SenderIDStatus Neutral;OrigIP:90.169.106.204
X-EXCLAIMER-MD-CONFIG: 079171ba-394f-46d5-a160-56e416712e8e
X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0
X-MS-Exchange-Organization-AuthSource: rws-mail.rwsservices.net
X-MS-Exchange-Organization-AuthAs: Anonymous
The emails use a different sender email address every time and there is always a poem in very light grey writing in the body of the email. The drugs are always misspelt as well. Is this why these are getting through?
Thanks
Robin
Robin Wilson

Similar Messages

Exchange 2013 Content filter agent quarantined message: wrong address appears when I click "Send Again"

Hello,
This is a strange one. I have Exchange 2013 and outlook 2013 and I have been using the content filter agent as a layer of spam protection since we were on 2008 and 2007. I redirect all my spam to a quarantine mailbox and examine it daily for false positives.
When I find one I click "Send Again" from the message in the quarantine mailbox to forward it on to the original sender. Normally Oulook automatically populates it with the original recipient. Today I noticed one that, for some reason, inserted "groupwise-"
in the front of the address(so for example "[email protected]:3:1") This concerns me as there is no such address and I have no idea where it is pulling this address from. I don't
use groupwise software. The quarantine mailbox has info in a postmaster and abuse reporting email. It shows the address correctly as "[email protected]" Only when you click "Send Again" does it
insert this groupwise address. Any ideas why?
This has only happened on one email so far.
Thanks.

Hi,
I noticed that the issue happened when you released quarantined messages to their intended recipients by using the Send Again feature in Microsoft Outlook.
Does the issue happen to all quarantined mailboxes. Please confirm if the messages have been sent to the intended recipients successfully or sent failed with NDR returned because of the wrong email address.
Please try to
disable the mailbox quarantine then enable to check whether the issue persists. Also make sure there is no third-party program installed in Exchange server and local machine for quarantine mailboxes.
Regards,
Winnie Liang
TechNet Community Support

Exchange 2013: Content Index State Failed

I am running two, two node DAG's with Exchange 2013.
One DAG pair is running 5 databases with Server 2012 Standard and the second DAG pair is running Server 2008 R2 SP1 Standard with a single shared database.
No matter what I try, ALL 6 databases show "ContentIndexState: Failed" with "ContentIndexErrorMessage: An internal error occurred for the database or its index.".
I have tried rebuilding the indexes manually, automatically and manually copying the database files between servers. I also receive errors when trying to failover the databases because the content index state is failed.
In my test environment I have a very similar setup working fine with no issues.
Please let me know what I can try to get this resolved.
The error I receive when running the following set of commands is:
suspend-MailboxDatabaseCopy dag2db1\mbox1
update-MailboxDatabaseCopy dag2db1\mbox1 -deleteexistingfiles
[PS] C:\Windows\system32>update-mailboxdatabasecopy dag2db1\mbox1 -deleteexistingfiles
Confirm
Are you sure you want to perform this action?
Updating database copy DAG2DB1\MBOX1 on server MBOX1
[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): a
WARNING: Seeding of content index catalog for database 'DAG2DB1' failed. Please verify that the Microsoft Search (Exchange) and the Host Controller service for Exchange services are running and try the operation again. Error: Therevwas no endpoint listening
at net.tcp://localhost:17063/Management/SeedingAgent-0A2745DF-4522-42AB-9115-5DDE9EDEF1C612/Single that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details..
[PS] C:\Windows\system32>

Hi Folks,
Here we go;
"On
August 14th, we announced the removal of the
MS13-061 Security Update for Exchange Server 2013 due to an issue where the patch changed settings for the search infrastructure, placing the content index for all databases into a failed state. As of today, we have released updated security updates
for both Exchange 2013 RTM CU1 and Exchange 2013 RTM CU2."
Details below;
http://blogs.technet.com/b/exchange/archive/2013/08/27/now-available-updated-release-of-ms13-061-security-update-for-exchange-server-2013.aspx
Yavuz Eren Demir
After installing this patch (Exchange2013-KB2874216-v2-x64-en.msp) seeding of the databases was impossible.
Error:
warning
Seeding of content index catalog for database 'Database02' failed. Please verify that the Microsoft Search (Exchange) and
the Host Controller service for Exchange services are running and try the operation again. Error: Could not connect to net.tcp://localhost:3863/Management/SeedingAgent-F293698C-B2D0-40CA-A2C3-FB37982E708712/Single. The connection attempt lasted for a time
span of 00:00:02.0592000. TCP error code 10061: No connection could be made because the target machine actively refused it 127.0.0.1:3863. .
Looking at the two services mentioned in this warning I've noticed the Microsoft Exchange Search Host Controller (HostControllerService)
was disabled
After Changing it to Automatic and enabling it, the problem was salved

Exchange 2013 migration ends as Failed but the migration is OK

Hi
After Exchange 2013 SP1 I started getting this error when migration users to 2013 or within 2013.
We are now at CU5 and the problem remains.
When a migrations has come to the Synced or Successful state the ECP shows status Failed!
If you view details you see the right status. In the report you see no errors, all looks good.
So you you just synced a mailbox you have to complete the migration from PowerShell.
I see no event in the log about this.
I tried recreating the arbitration mailbox but no luck.
Is more a cosmetic problem but a bit annoying!
Anyone seen this?
Regards
Robert

Hi Robert,
Does the issue happen to all migrated mailboxes or just some specific mailbox?
Please click Refresh
Please use the Exchange Management Shell to display migration user statistics:
Get-MigrationUser -Identity [email protected] | FL
Get-MigrationUserStatistics -Identity TestUser@ contoso.com -IncludeReport | FL
Here is an article about Migration status report in EAC:
http://technet.microsoft.com/en-us/library/jj898491(v=exchg.150).aspx
If possible, please also collect the EAC screenshot about your issue and the commands results here without sensitive information for further analysis.
Regards,
Winnie Liang
TechNet Community Support

Exchange 2013: owa page shows up but returns bad request when logged in

Environment: Exchange 2013 CU6 /Windows Server 2012 R2
Just installed the patch yesterday, owa and ecp was working fine after the install but it broke for some reason.
was able to get ecp and powershell running but still cant up owa.
owa website can be accessed online, but once logged in it will throw errors below:
Firefox:bad request
IE:https://mail.domain.com/owa/auth.owa
tried to recreate Virtual directories for ecp and owa but to no avail.
both default website authentication shows basic,forms and fba (for ecp/owa)
checked IIS settings: no redirection details for both http redirect by default didnt touch it as well.
just wondering if anyone experienced the same and how they got it to be resolved, also is there a way to check what is the current authentication method for the backend server
not sure if i am checking it correctly but when i go to IIS>exchange back end, i cannot enable basic and forms as the same time...
thanks in advance

Hi,
From your description, I recommend you use the following cmdlet to change the authentication method of the "owa" virtual directory to Windows authentication.
Set-Owavirtualdirectory -identity "servername\owa (Exchange Back End)" -WindowsAuthentication $True -Basicauthentication $false -Formsauthentication $false
And then run the following command on both the Client Access and Mailbox servers to restart IIS and check the result.
iisreset /noforce
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

Help my Exchange 2013 server is sending out thousands of spam mails!

Hi all,
today i noticed that my Exchange server was using 100% cpu and memory.I noticed that edgetransport service was using all the resource.
Then i opened queue viewer and saw thousands of mails in the queue.Then then get the annoying message that it cannot show more than 1000 messages.I click ok and stop the refreshing.I could mark all e-mails and choose suspend,but after that it starts to refresh
and same annoying message keeps popup (cant display more than 1000 messages)
So i have blocked all incoming port 25 on my TMG and also blocked all trafic out from the mail server.
I than ran the following command on My exchange server : Remove-Message -Server mail01 -filter {status -eq "suspended"} -WithNDR $false
Doesnt seem it helped,since there are still over 1k messages in the queue!
I deleted the queue folder under C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\ and it re-created new folder.Still all queue arent removed.
How can i remove all messages in the queue viewer?
I also find it strange why outsiders manage to relay on my server,since i only set allow for couple of internal servers?
Scanned those and no virus there (i dont use those servers to download anything)
any advice please?
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

Would take me to much time to remove one ID by one,since i had over 3k in the queue.
Ended up with the following command:
Remove-Message -Filter {FromAddress -like "*@*"} -WithNDR $false
Remove-Message -Filter {FromAddress -like "*<>*"} -WithNDR $false
First will remove all messages that contains @
Second will remove all messages that contains <> (seems like lots had this in fromaddress)
Then finally all gone and cpu and mem back to normal.
Now have to find a way to block all IPs from China and Russia on my TMG!
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

Exchange 2013 SPAM filter- can wildcards be used for partial word matching?

We have migrated to Exchange 2013 and have set up the Anti-Spam and Anti-Malware features. One thing I am trying to figure out is how to setup a wildcard filter for partial words. For example, I have Viagra listed but it doesn't catch something
like USviagra. How would I set a filter for catching anything that ahs the word Viagra buried in it?
Thanks.

I have also seem a large increase in spam since upgrading to Exchange 2013.The malware engines are enabled and content filtering is turned on but everyone is getting about 20 emails a day from the Pfizer eStore. ForeFront used to block it all.
Also images are blocked in standard emails but in these Viagra emails the images all show!
The title is always a bit different too and it is spelt with extra i's. Surely this shouldn't be too much and defeat the content filter!
Robin
Robin Wilson

Unable to send to external email recipients - Multi Tenant Exchange 2013 - MultiRole servers in DAG

Greetings all, I hope someone can help.
I have created a Exchange 2013 multi-tenant organization, with two servers, both multi-role - CAS and Mailbox roles.
Internal mail flow is fine (external email addresses can send to the domain).
External firewall port forwards ports 443 and 25 to the Internal DAG IP address.
There are two multi-role Exchange servers that are members of the DAG.
I am able to connect to OWA and ECP via https://externalIP/OWA and https://alias.domain.com/OWA
No SSL certificates have been purchased or installed yet.
Exchange URLs have not been changed since default configuration at install.
OWA and ECP works both internal and external.
External DNS works with SPF and PTR records correctly configured
Exchange RCA - Send test only fails with one Spam Listing (this Blacklist provider now flags all domains and you cannot ask to be removed)
Send Connectors are the default ones created during install. Receive connector is standard configuration with - * -
When sending email to an external address, I receive a failure notice
ServerName.test.corp.int gave this error:
Unable to relay
Your message wasn't delivered due to a permission or security issue. It may have been rejected by a moderator, the address may only accept email from certain senders, or another restriction may be preventing delivery.
More Info -
ServerName.test.corp.int
Remote Server returned '550 5.7.1 Unable to relay'
I have been troubleshooting this for many hours with no progress.
I have created new Send Connectors for the server that is advising that it is unable to relay, but they have all failed.
I have tried setting the Internal IP address for Exhange Server 1 (Exchange Server 2 reports failure), with most combinations of Security (Anonymous, Exchange Users, etc).
I have also tried with the IP range 192.168.11.0/24 to allow the whole the subnet, I still receive the unable to relay failure notice.
I have tried this guide - hxxps://glazenbakje.wordpress.com/2012/12/30/exchange-2013-how-to-configure-an-internal-relay-connector/ - with different combinations, still no resolution.
I am at a loss as to why I can't send out with the default configuration. I would assume that email would flow out without any changes, but this does not happen.
Can someone please assist before I lose my sanity.
Thanks in advance,
Terry

Greetings all, I hope someone can help.
I have created a Exchange 2013 multi-tenant organization, with two servers, both multi-role - CAS and Mailbox roles.
Internal mail flow is fine.
Incoming mail from external senders is also fine. -
external email addresses can send to the domain).
External firewall port forwards ports 443 and 25 to the Internal DAG IP address.
There are two multi-role Exchange servers that are members of the DAG.
I am able to connect to OWA and ECP via https://externalIP/OWA and https://alias.domain.com/OWA
No SSL certificates have been purchased or installed yet.
Exchange URLs have not been changed since default configuration at install.
OWA and ECP works both internal and external.
External DNS works with SPF and PTR records correctly configured
Exchange RCA - Send test only fails with one Spam Listing (this Blacklist provider now flags all domains and you cannot ask to be removed)
Receive Connectors are the default ones created during install. Send connector is standard configuration with - * -
When sending email to an external address, I receive a failure notice
ServerName.test.corp.int gave this error:
Unable to relay
Your message wasn't delivered due to a permission or security issue. It may have been rejected by a moderator, the address may only accept email from certain senders, or another restriction may be preventing delivery.
More Info -
ServerName.test.corp.int
Remote Server returned '550 5.7.1 Unable to relay'
I have been troubleshooting this for several days with no progress.
I have created new Receive Connectors for the server that is advising that it is unable to relay, but they have all failed.
I have tried setting the Internal IP address for Exhange Server 1 (Exchange Server 2 reports failure), with most combinations of Security (Anonymous, Exchange Users, etc).
I have also tried with the IP range 192.168.11.0/24 to allow the whole the subnet, I still receive the unable to relay failure notice.
I have tried this guide - hxxps://glazenbakje.wordpress.com/2012/12/30/exchange-2013-how-to-configure-an-internal-relay-connector/ - with different combinations, still no resolution.
Even more info - Further troubleshooting -
I found my one of my Exchange servers had an extra NIC. I have since added a second NIC to the other server, so now both Exchange servers have dual NICs. I removed the DAG cleanly and recreated the DAG from scratch, using this link -
hxxp://careexchange.in/how-to-create-a-database-availability-group-in-exchange-2013/
The issue still exists, even with a newly created DAG. I also found that the Tenant Address Books were not 'applied'. I applied them but still no resolution
I think the issue is related to multi-tenant configuration even though the error says that it can't relay. The unable to relay message can appear when sending from a domain that the Organization does not support. Like trying to email as [email protected]
when you domain name is apple.com - But through extensive research I still can't resolve the issue.
Can someone please assist before I lose my sanity.
Thanks in advance,
Terry

Single item recovery in Exchange 2013

I am looking for some help in identifying the simplest process to recover a single item in Exchange 2013 in a scenario where the item is no longer available in the dumpster (i.e. a retained deleted item).
In Exchange 2010 the process was:
Restore the mailbox database from backup to the Recovery database
Restore the item using the Restore-Mailbox cmdlet with the -AllContentKeywords parameter to identify and restore the individual item (or items) to a target folder in the user's mailbox.
The Restore-Mailbox cmdlet is no longer available in Exchange 2013.
I guess one possible option is the following:
Restore the mailbox database from backup to the Recovery database
Restore the mailbox to a dummy mailbox (or Discovery Mailbox) using New-MailboxRestoreRequest.
Use the Search-Mailbox cmdlet to find the item in the dummy mailbox and restore it to a target folder in the user's mailbox.
It just seems like a very long-winded method to restore a single item. Any way to do this better?
Alexei

Hi ,
In exchange 2013 single item recovery work as follows .
Scenario 1 : Items from the deleted items folder and also the hard deleted items (shift + delete) will move it to the dumpster (i.e deletions folder) which is an sub-folder in recoverable deleted items folder.On that deletions folder items will be retained
based upon retention period .
Scenario 2 : In case if we move the items from the deletions folder it will get move in to the purges folder (if single item recovery is enabled) .purges folder is also one more sub folder for recoverable deleted items folder .
In purges folder items will be again started to get retain for the whole retention period (I mean to say retention period count will not get calculated from the day when it moves from the deletions folder to purges) instead again that particular email item
start to get retained till the whole retention period get's over .
You can use mfcmapi tool and e-discovery search in exchange 2013 to recover the items which is moved from deletions folder to purges folder.
Reference blog : http://www.msexchange.org/articles-tutorials/exchange-server-2010/high-availability-recovery/single-item-recovery-part1.html
For an additional information litigation and In place hold is one of the feature in exchange which will retain emails for the years that you want .
http://blogs.technet.com/b/exchange/archive/2013/12/11/litigation-hold-and-in-place-hold-in-exchange-2013-and-exchange-online.aspx
Note : from 2010 on wards single item recovery feature is available.
http://blogs.technet.com/b/exchange/archive/2009/09/25/3408389.aspx
Regards
S.Nithyanandham

Exchange 2013 Windows Server 2012 NLB and DAG on the same server

Hi all, I am installing Exchange 2013 infrastructure with two servers.
Both servers have the CAS and Mailbox roles.
For mounting on High Availability, will create a DAG.
Client Access I have no external Network Load Balancer.
I thought about installing the NLB servers in the DAG members, this could not be done before.
I do not know if in Windows Server 2012 and Exchange 2013
Can I install NLB on members of a DAG?
regards
Microsoft Certified IT Professional Server Administrator

Hi,
I’m afraid that WNLB and DAG cannot coexist in the same server. Because WNLB is incompatible with Windows failover clustering. If we're using an Exchange 2010 DAG and we want to use WNLB, we need to have the Client Access server role and the Mailbox server
role running on separate servers.
For more information, you can refer to the following article:
http://technet.microsoft.com/en-us/library/ff625247(v=exchg.141).aspx
Thanks,
Angela Shi
TechNet Community Support

Monitoring for Users Exchange 2013

Hi All,
How to find out which mailbox is generating high number of logs in Exchange 2013 ..............?

Hi,
You can monitor Exchange 2013 with SCOM 2012
Refer from:
http://www.msexchange.org/articles-tutorials/exchange-server-2013/monitoring-operations/monitoring-exchange-2013-scom-2012-part1.html
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please
make sure that you completely understand the risk before retrieving any suggestions from the above link.
Best Regards.

Unable to prevent backscatter with Exchange 2013

Hi,
From my research, it seems that Exchange 2013 might have an inherent flaw (although I hope I am wrong).
Unlike all previous versions of Exchange, the 'Filter recipients who are not in the Directory' feature doesn't work the same.
Exchange 2013 seems to check the recipient only after getting the message.
mail from:<[email protected]>
250 2.1.0 Sender OK
rcpt to:<[email protected]>
250 2.1.5 Recipient OK
data
354 Start mail input; end with <CRLF>.<CRLF>
Write some Text Here
550 5.1.1 User unknown
And here is Exchange 2010 for example:
mail from:<[email protected]>
250 2.1.0 Sender OK
rcpt to:<[email protected]>
550 5.1.1 User unknown
This is rather a big problem, because it means that every Exchange 2013 installation is just sitting and waiting to be abused with backscatter spam, and unlike previous incarnations of Exchange, there is nothing that can be done about it. Once an Exchange 2013
server has been abused with backscatter spam, its outgoing IP addresses will become blacklisted very quickly.
The only possible solutions I've found seem to require multiple server configurations and big complexity.
What can be done about this?

Hi Chukee1,
This is a known issue in Exchange 2013, as a workaround for this issue, you can enable recipient filter on Edge server.
http://technet.microsoft.com/en-gb/library/bb123891%28v=exchg.150%29.aspx
Here is a similar thread for your reference.
http://social.technet.microsoft.com/Forums/en-US/75bb174e-a4b9-4d8e-9d8e-5d4d5bc32dc3/exchange-2013-backscatter-issue-recipient-validation-without-edge?forum=exchangesvrsecuremessaging
Hope this is helpful to you.
Best regards,
Belinda Ma
TechNet Community Support

MS Exchange 2010 Sp3 Ent Migration to Exchange 2013

Hello,
We currently have 2 Exchange 2010 SP3 servers in 1 DAG. Both servers host CAS, Mailbox and Hub Role.
I want to introduce a 3rd Exchange 2013 Server and slowly move users onto a new DAG I build in Exchange 2013.
Can I create a 3rd Exchange 2013 Server with CAS and Mailbox Server Role and make the 3rd Exchange server (2013) a member of the existing (2010) CAS array then slowly perform local move requests for users mailboxes
from my Exchange 2010 DAG to the Exchange 2013 DAG without any disruption to my outlook, OWA and AS clients?
Exchange 2010 (Windows 2008 R2)
Exchange 2013 (Windows 2012 R2 DataCenter)

Hi,
In Exchange 2013, all Outlook connectivity (Internal and External) takes place over Outlook Anywhere(RPC/HTTP). Thus, CAS array which is used internal for RPC/TCP protocol (MAPI) no longer exists in Exchange 2013.
For your coexistence environment and the plan to migrate all mailboxes to Exchange 2013 in the future,
we need to set all virtual directories for CAS 2013 and enable Outlook Anywhere for Exchange 2010. If the mailbox is moved to Exchange 2013, the Outlook client would connect to the server which is set in Outlook Anywhere External host name
and Internal host name instead of CAS array. If all configurations are proper, CAS 2013 would also proxy the service requests for Exchange 2010 users.
Here are some reference about Client Connectivity in an Exchange 2013 Coexistence Environment:
http://blogs.technet.com/b/exchange/archive/2014/03/12/client-connectivity-in-an-exchange-2013-coexistence-environment.aspx
Exchange 2013 Client Access Server Role
http://blogs.technet.com/b/exchange/archive/2013/01/25/exchange-2013-client-access-server-role.aspx
Exchange Server 2013 Client Access Server High Availability
http://exchangeserverpro.com/exchange-2013-client-access-server-high-availability/
Exchange 2010/2007 to 2013 Migration and Co-existence Guide
http://msexchangeguru.com/2013/05/10/exchange2013-migration/
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please
make sure that you completely understand the risk before retrieving any suggestions from the above link.
Regards,
Winnie Liang
TechNet Community Support

Exchange 2013 Reverse dns setup

I recently migrated from SBS to Standard Windows servers with exchange 2013 and I'm having a heck of a time fighting spam. Mailflow is working fine, and we setup spam fighter exchange module which is catching most of the spam. However, it is missing some
that are spoofing our domain name with addresses that do and don't exist. I've read that the best way to stop this is to setup spf filtering and to do this you should setup reverse dns ptr records so you don't get blacklisted. The directions are rather confusing.
They say to setup a ptr record with your mail server's ip address. Here are my questions...
Do I have to set this up on both my dns and my service providers dns?
I currently have a A record and a ptr record pointing to the internal ip address on my internal dns server with the actual server name, but no records pointing to remote.domain.com.
Do I need to create additional A and PTR records using the External IP and remote.domain.com?
Right now my mx record points to mail.domain.com, but all of our connectors use remote.domain.com. Should the mx be changed to remote.domain.com?
Thanks for any help.

I've read that the best way to stop this is to setup spf filtering and to do this you should setup
reverse dns ptr records so you don't get blacklisted
Some antispam products to a reverse lookup on your IP address to make sure it matches the entry in the forward lookup zone. It does this to check that your server
is not spoofing the server name.
This won't necessarily prevent getting blacklisted (especially if you are sending spam), but it is definitely recommended for your mail architecture.
Do I have to set this up on both my dns and my service providers dns?
You will need to set this up on your Service Provider's DNS, as they will
technically own the IP address, and lease it to you.
Best practice is to have reverse lookup zones for your internal subnets in your internal DNS as well.
But this is not so much a spam related thing, as just a good idea.
Right now my mx record points to mail.domain.com, but all of our connectors use remote.domain.com.
Should the mx be changed to remote.domain.com?
This depends what these are used for. As you have come from an SBS environment, I'm guessing that both
of these names resolve to the same public IP address. If this is the case, you can leave the MX records as they are. If this is not the case, let me know and we'll discuss it later.
Let's say that you have a server called
mbx.contoso.com internally with an IP of
192.168.0.1. Externally, this server is known as mail.contoso.com
and has an IP address of 123.123.123.123.
In this case, you would do two things:
On your internal DNS server(s), create a reverse lookup zone for
192.168.0.0 and create a PTR record for
mbx.contoso.com with the IP of 192.168.0.1. This may already be done from when you set up Active Directory initially
Contact your ISP, and ask them to setup a
PTR record for mail.contoso.com for the IP
123.123.123.123

Public Folders on multiple Exchange 2013 servers

Two companies (lets call them WestCoast Company and EastCoast Company) have merged. Each one has Ex2010 with PFs of local scope (the companies don't need access to each other's PFs). I want to move them to a single Exchange Organization with one Exchange
server in each office and possibly a 3rd Exchange in a data center. I am looking for the best/simplest solution for those legacy PFs. Questions:
- With Exchange 2010 I can only have one PF database so I will have to merge the PF structures. If the "master" PF DB sits in the data center I can choose which folders to replicate to each regional Exchange server (ie I can have only WestCoast
folders on the WestCoast Exchange and similar for East Coast). Are these statements correct?
With Exchange 2013:
- Can I have more than one PF trees (one per PF mailbox) or am I limited to a single PF hierarchy?
- If only one PF hierarchy, am I forced to have one location that holds all the content or can the content remain distributed in different locations?
- Can I have content (or PF mboxes) that only show up on some of the Exchange servers? (ie WestCost PFs will show up only on WestCoast Exchange)
- Do the PF limits (10,000 folders, 1 million items, etc) apply per PF mbox or for the whole thing?
Thanks

There is just one public folder hierarchy. You can assign sub-trees under the root to different mailbox databases, though, and through permissions you could restrict who can see each of them.
You can have public folder mailboxes mounted in different mailbox databases, with different databases mounted in different locations. So you could have the Europe folders in a mailbox in a mailbox database mounted on a European server, and the Americas
folders in a mailbox in a mailbox database mounted on an Americas server.
You can do that but only by grouping public folder mailboxes in mailbox databases that are mounted where you want them to be mounted. As stated before, you might be able to hide folders through permissions, not by where they are mounted.
Yes, the 10,000-folder limit applies to the organization. If you have more than that, wait until the limit is increased.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

High Amount of Spam on Exchange 2013 - Content Filtering is Enabled but Pfizer Spam Filling Up Everyone's Mailboxes

Similar Messages

Maybe you are looking for