O365 Blocking External Access to Distribution Lists

[FWBD]

We've had a wave of spam emails go around and some of them have got a hold of our student distribution lists which has been fun. I'm looking at setting up some mail flow rules to redirect any external emails sent to a DL to a generic mailbox called Spam. However I've been playing around with the rules this morning and can't get it working. Has anyone else had any experience with this?

 

Currently my rules are like this;

 

If the sender is located Outside the organisation

 

and

 

If the recipient address matches TestDL@domain

 

Then redirect and generate report etc,

 

Cheers!

[Mako]

Are your distribution lists O365 or are they sync'd from on-prem?

[FWBD]

Mostly synced on prem but I think one or two might be cloud only

[Mako]

Nice. I had similar issues with Mail Flow rules. In theory it should work fine, but I ended up using the following.

 

For cloud-based :

Go to Exchange Admin Centre > Recipients > Mailboxes > Groups> Find your DL/Group > Edit > Delivery Management > Set "Only senders inside the organisation" and choose which users/groups are allowed.

 

For on prem:

A bit tricker, requires editing AD for which you may get an error that "no editor is available" (or words to that effect). You'll need to PowerShell (or other method) to change the following attiributes on the group:

msExchRequireAuthToSendTo = TRUE

dlMemSubmitPerms = add the group(s) that you want to authorise, e.g ALL STAFF

AuthOrig = use this variable for individuals

 

These are the same fields that Azure reads for the cloud, so will set the same attributes at the next AD sync.

 

I have the above set up as my distribution lists are sync'd from on-prem, and nobody external can e-mail any of the lists, and internally only specific groups can e-mail specific lists (i.e students cannot e-mail their year group as a whole).

 

Edit: should also mention that the above settings for AD may be missing if you've never had an on-prem exchange and/or extended your AD schema.

 

Hope that helps.

Edited May 26, 2021 by Mako

[FWBD]

That's awesome I've just tested this on my test dist list and it sent a bounce back from the post master which is great. Pity the rules won't work as some reporting on it would be handy but I'll be happy to have less spam flying across our network!

 

For reference this was the command used;

Import-module activedirectory

 

Set-ADObject “CN=TestEmailGroup,OU=DL,DC=Test,DC=com” -Add @{dLMemSubmitPerms=”CN=ADGroup,OU=Security Groups,DC=Test,DC=com”}

Thanks again

 

[Mako]

No problem.