Spam and Phising Emails - Exchange

[plumyeti]

Good morning,

 

please can someone advise what rules etc I can iplement to reduce the amount of spam we are receiving.

 

They only seem to be coming into our distrubutions list.

 

See some examples below.

Edited August 9, 2024 by plumyeti
Correct Typo

[andy_b]

First email was caught by us because I send any email from onmicrosoft domain to quarantine.

 

Second email, do you need external sender's to send to your DG? I mostly have that disabled.

[plumyeti]

First email was caught by us because I send any email from onmicrosoft domain to quarantine.

 

Second email, do you need external sender's to send to your DG? I mostly have that disabled.

 

I would definetly agree that we don't need external emails to most DG.

However I have previosuly been told (by previous technician) that we can't block the external due to the DG originating from AD.

[Steve21]

I would definetly agree that we don't need external emails to most DG.

However I have previosuly been told (by previous technician) that we can't block the external due to the DG originating from AD.

 

Under AD there's an attribute called dLMemSubmitPerms that you can put a group in that is "only" allowed to send to it.

 

So for example we set our AllStaff group to only allow users of AllStaff to send to it, so it blocks anyone else by default

 

Steve

[plumyeti]

Under AD there's an attribute called dLMemSubmitPerms that you can put a group in that is "only" allowed to send to it.

 

So for example we set our AllStaff group to only allow users of AllStaff to send to it, so it blocks anyone else by default

 

Steve

 

I have had a look. However when I attempt to edit the attribute I get an error message.

[Steve21]

Yep that's expected if you try to edit it manually.

 

Do it via powershell e.g.:

Set-ADObject "CN=AllStaff,OU=Example,OU=Groups,OU=Users,OU=EX,DC=Example,DC=internal" -Add @{dLMemSubmitPerms="CN=AllStaff,OU=Example,OU=Groups,OU=Users,OU=EX,DC=Example,DC=internal"}

 

Use the DN from the source group on the 1st part and the group you want to be able to send to it on the 2nd part

 

Steve

[plumyeti]

Thank you that sems to have worked.