none
Exchange 2016 - Cannot find FrontEnd and SpamHaus RRS feed

  • Question

  • hello, We are invaded by spam (more than 700 in a week) (small business).
    SpamHaus does not seem to be activated.

    ****** = my company name
    [PS] C: \ Windows \ system32> Get-IPBlockListProvidersConfig


    RunspaceId: deee2020-df1b-41f2-9d32-9f4adb838e34
    Name: IPBlockListProviderConfig
    BypassedRecipients: {}
    Enabled: True
    ExternalMailEnabled: False
    InternalMailEnabled: False
    AdminDisplayName:
    ExchangeVersion: 0.1 (8.0.535.0)
    DistinguishedName: CN = IPBlockListProviderConfig, CN = Hygiene Message, CN = Transport Settings, CN = ********* SA, CN = Microsoft Exchange, CN = Services, CN = Configuration, DC = Sekoya, DC = Local
    Identity: IPBlockListProviderConfig
    Guid: ab279de1-9626-4189-b073-30e297bc629d
    ObjectCategory: ******* Local / Configuration / Schema / ms-Exch-Message-Hygiene-IP-Block-List-Provider-Config
    ObjectClass: {top, msExchAgent, msExchMessageHygieneIPBlockListProviderConfig}
    WhenChanged: 25.04.2019 16:17:13
    WhenCreated: 05.12.2018 14:34:28
    WhenChangedUTC: 25.04.2019 14:17:13
    WhenCreatedUTC: 05.12.2018 13:34:28
    OrganizationId:
    Id: IPBlockListProviderConfig
    OriginatingServer: *********. *********. Local
    IsValid: True
    ObjectState: Unchanged
    ---------
    [PS] C: \ Windows \ system32> Get-IPBlockListProvider

    Name LookupDomain Priority
    ---- -------- --------
    zen.spamhaus.org zen.spamhaus.org 2

    -------------------
    [PS] C: \ Windows \ system32> Get-TransportAgent

    Identity Enabled Priority
    -------- ------- --------
    True Transport Rule Agent 1
    DLP Policy Agent True 2
    Retention Policy Agent True 3
    Supervisory Review Agent True 4
    Malware Agent True 5
    Text Messaging Routing Agent True 6
    Text Messaging Delivery Agent True 7
    System Probe Drop Smtp Agent True 8
    System Probe Drop Routing Agent True 9

    ----------------------
    [PS] C: \ Windows \ system32> Get-TransportAgent -TransportService FrontEnd
    Creating a new session for implicit remoting of "Get-TransportAgent" command ...

    Identity Enabled Priority
    -------- ------- --------
    Connection Filtering Agent True 1

    ----
    [PS] C: \ Windows \ system32> Test-IPBlockListProvider * spamhaus * -IPAddress 192.203.178.107


    RunspaceId: deee2020-df1b-41f2-9d32-9f4adb838e34
    Provider: zen.spamhaus.org
    ProviderResult: {127.0.0.2}
    Matched: True

    I still have to activate both commands, but I prefer to wait to be sure that SpamHaus is well configured:
    if internal users,

    Set-IPBlockListProvidersConfig -InternalMailEnabled $ true

    External users:

    Set-IPBlockListProvidersConfig -ExternalMailEnabled $ true

    Do you have a track to help me solve the problem?
    It's like he was there, but does not filter emails.


    Thank you in advance,


    Tchoune


    • Edited by Tchoune Wednesday, June 19, 2019 8:23 PM
    Wednesday, June 19, 2019 8:22 PM

All replies

  • Hi Tchoune,

     

    Connection filtering is an antispam feature in Exchange Server that allows or blocks email based on the message source. Connection filtering is performed by the Connection Filtering agent that's available only on Edge Transport servers. You could run the cmdlet below to check.

     

     Get-TransportAgent -TransportService Edge

     

    1.To add Spamhaus to your connection filter agent, run the following command on the Edge Transport server.

     

    Add-IPBlockListProvider -Name Spamhaus -LookupDomain zen.spamhaus.org -AnyMatch $true -Enabled $true -RejectionResponse "IP address is listed by Spamhaus"

     

    2.To view how connection filtering uses IP Block List providers, run the following command:

     

    Get-IPBlockListProvidersConfig | Format-List *Enabled,Bypassed*

     

    Here're some related links for your reference:

     

    Connection filtering on Edge Transport servers

    Connection filtering procedures on Edge Transport servers

     

    Regards.

    Kelvin Deng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Thursday, June 20, 2019 5:34 AM
  • Hello,
    I do not want Exchange Edge installed, we are a small company.

    I run the script to activate the following agents, but I find myself blocking. When I send an email it goes directly into spam internally and externally.

    Content Filter Agent False 10
    Sender Id Agent False 11
    Sender Filter Agent False 12
    Recipient Filter Agent False 13
    Protocol Analysis Agent False 14

    I based myself on this post where I think I have the same configuration

    https://social.technet.microsoft.com/Forums/en-US/d98bfb11-ad2a-4308-ac5d-94ac8cca3c20/exchange-server-2016-ipblocklistprovider?forum=Exch2016MFSM

    Do you have another idea to help me?

    Thursday, June 20, 2019 9:22 AM
  • Hi Tchoune,

     

    1.Before you install the transport agents, are the outbound messages verified as spam?

    2.What's your current situation, mounts of inbound spam messages to the Exchange server and the outbound messages from internal become spam?

     

    As the links I provided in my last reply, the Connection Filtering agent and the Attachment Filtering agent aren't available on Mailbox servers. They're only available on Edge Transport servers, and they're installed and enabled there by default.

     

    Although the Recipient Filter agent is available on Mailbox servers, you shouldn't configure it. When recipient filtering on a Mailbox server detects one invalid or blocked recipient in a message that contains other valid recipients, the message is rejected.

     

    please run the following cmdlet to uninstall  Connection Filtering agent and Recipient Filter Agent from the Mailbox server.

     

    Uninstall-TransportAgent "Connection Filtering Agent" -TransportService FrontEnd

    Uninstall-TransportAgent "Recipient Filter Agent" -TransportService Hub

     

    Then install the following antispam agents on your Exchange server.

     

    • Content Filter agent
    • Sender Filter agent
    • Sender ID agent
    • Protocol Analysis agent for sender reputation

     

    More details, please refer to the article: Enable antispam functionality on Mailbox servers

     

    Regards.

    Kelvin Deng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Monday, June 24, 2019 9:29 AM
  • Hi Tchoune,

     

    I am writing here to confirm with you how the thing going now?

     

    If you need further help, please provide more detailed information, so that we can give more appropriate suggestions

     

    Regards,

    Kelvin Deng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Thursday, June 27, 2019 1:48 AM