====== Exchange E-Mail Security ======

See also **[[internet:mail:exchange:exchange_track_msg|Using the Exchange Shell to Track Messages]]**

===== Enable AntiSpam =====

https://www.techieshelp.com/exchange-2013-enable-anti-spam/

===== Whitelist a Sender or Domain =====

https://www.informaticar.net/exchange-server-whitelisting-domains-and-email-addresses

===== Whitelist an IP Address or Range =====

  * ''Get-IPAllowListEntry''
  * ''Add-IPAllowListEntry''
  * ''Remove-IPAllowListEntry''

===== Show Mailbox Anti-Spam =====

<file>
Get-MailboxJunkEmailConfiguration -Identity <e-mail address>

Get-Mailbox -Identity <e-mail address> | Format-List SCL*,Bypass*,*SenderAuth*
</file>

===== SMTP Relay Filters =====

http://woshub.com/configure-spam-protection-in-exchange-2013-rbl-providers/

https://blog.ahasayen.com/smtp-relay-exchange-internalsmtpservers/

https://docs.microsoft.com/en-us/Exchange/antispam-and-antimalware/antispam-protection/antispam-on-mailbox-servers?view=exchserver-2019

Get the current list:

<file>
Get-TransportConfig | fl InternalSMTPServers
</file>

Replace list:

<file>
Set-TransportConfig -InternalSMTPServers 192.168.1.0/24, 192.168.5.2
</file>

Add to list:

<file>
Set-TransportConfig -InternalSMTPServers @{Add="<ip address1>","<ip address2>"...}
</file>

===== DKIM =====

<note important>Exchange 2019 (on-prem) does not verify incoming DKIM signatures or sign outgoing by default.</note>

==== Receiving ====

We currently rely on MailCleaner (inbound mail filtering) to verify DKIM signatures as Exchange does not do so.

==== Sending ====

:!: This free tool will sign outgoing messages for the domains you specify.

<note tip>The GUI configuration tool is not added to the Start Menu but is located here: "C:\Program Files\Exchange DkimSigner\Configuration.DkimSigner.exe"</note>

https://opentechtips.com/how-to-configure-dkim-on-exchange-2019-the-simple-way/

https://github.com/Pro/dkim-exchange/wiki/Installation

https://github.com/Pro/dkim-exchange/wiki