Have you checked messaged header where the email originated from?
You need to implement SPF+DKIM+DMARC to avoid fraud and spoof emails.
To avoid people telnet to your server and send email to other domains, you need to enable recipient agent filter:
To check if your server is using the AddressBook for validation run the following command:
Get-AcceptedDomain | Format-List Name,AddressBookEnabled
It should provide you with a list of all accepted domains and if the AddressBook is enable or not. If by any chance Exchange is not Authoritative and the AddressBook is disabled then enable it with:
Set-AcceptedDomain <name of accepted domain> -AddressBookEnabled $true
Or, to enable for all domains (caution, make sure you are not relaying any domains before running this)
Get-AcceptedDomain | Set-AcceptedDomain -AddressBookEnabled $true
Now you should have Recipient Filter on your Mailbox Server and AddressBook enabled on your domain. However, if you test this now, it probably still will not work. That is because Validation is still disabled.
To check the status of validation run the following
Get-RecipientFilterConfig | FL Enabled,RecipientValidationEnabled
It should return that Recipient Filter is enable, but validation is not
Enabled: True
RecipientValidationEnabled : False
3. To enable validation run the following Set-RecipientFilterConfig -RecipientValidationEnabled $true
4. Restart the Exchange Transport service
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work
