By default, Exchange 2007 is configured to accept and relay e-mail only from hosts that can authenticate Exchange users. Both the "Default" and "Client" Receive connectors are configured in this manner. Authenticating is the simplest method to allow users to submit messages, and it is preferred in many cases.

The "ExchangeUsers" group lets authenticated users submit and relay messages. The permissions that are granted with the ExchangeUsers group are as follows:

• NT AUTHORITY\Authenticated Users {ms-Exch-SMTP-Submit}
  
  
• NT AUTHORITY\Authenticated Users {ms-Exch-Accept-Headers-Routing}
  
  
• NT AUTHORITY\Authenticated Users {ms-Exch-Bypass-Anti-Spam}
  
  
• NT AUTHORITY\Authenticated Users {ms-Exch-SMTP-Accept-Any-Recipient}
  
  

The specific system access control list (SACL) that controls relaying is ms-Exch-SMTP-Accept-Any-Recipient.

For computers that cannot authenticate Exchange 2007 users, you must create a new custom Receive connector. The custom Receive connector resembles a protocol listener and is used to authenticate users with Exchange. The most common example of this is an application server that must relay messages through Exchange. You must create a new Receive connector because you will want to include the remote IP Addresses that you want to allow.

1. Open the Exchange Management Console. Perform one of the following steps:

   • On a computer that has the Edge Transport server role installed, select Edge Transport, and then click the Receive Connectors tab.
     
     
   • To create a Receive connector on a Hub Transport server, expand Server Configuration in the console tree, and then select Hub Transport. In the results pane, select the server on which you want to create the connector, and then click the Receive Connectors tab.
     
     

2. In the action pane, click New Receive Connector. The New SMTP Receive Connector Wizard starts.

3. On the Introduction page, type a meaningful name for this connector in the Name field. This name is used to identify the connector.

4. In the Select the intended use for this connector field, select Custom to create a customized connector that will be used to connect with systems that are not running Exchange server.

5. Click Next.

6. On the Remote network settings page, enter the IP address or IP address range of the remote servers from which the connector will accept incoming connections. To add the remote IP address or remote IP address range, use one of the following methods:

   • To enter an IP address or subnet without a subnet mask, or to specify the subnet mask by using Classless Interdomain Routing (CIDR) notation, click Add or the arrow located next to Add, and then select IP Address.
     
     
   • In the Add IP address(es) of Remote Servers dialog box, enter the IP address by using one of the following methods:
     
     Enter an IP address without a subnet mask. For example, enter 192.168.1.0. If you do not specify a subnet mask by using CIDR notation, the classful default subnet mask is assumed.
     
     Enter an IP address by using CIDR notation. For example, enter 192.168.1.0/24.
     
     
   • To enter an IP address or subnet together with a subnet mask in dotted decimal notation, click the arrow located next to Add, and then select IP and Mask. In the Add Remote Servers - IP and Mask dialog box, enter the IP address and the subnet mask by using the following syntax:
     
     IP Address   For example, enter 192.168.1.0.
     
     Subnet Mask   For example, enter 255.255.255.0.
     
     
   • To specify an IP address range by using the first IP address and the last IP address in the range, click the arrow located next to Add, and then select IP Range. In the Add Remote Servers - IP Range dialog box, enter the IP address and the subnet mask by using the following syntax:
     
     Start Address   For example, enter 192.168.1.1.
     
     End Address   For example, enter 192.168.255.255.
     
     Because you cannot specify a subnet mask, the classful default subnet mask is assumed.
     
     

7. When you are finished, click OK, and then click Next.

8. On the New Connector page, review the configuration summary for the connector. If you want to change the settings, click Back. To create the Receive connector by using the settings in the configuration summary, click New.

9. On the Completion page, click Finish.

Create an Externally Secured Connector for the Custom Receive Connector

Creating an externally secured connector for the new Receive connector is preferred in most situations where an application will be submitting e-mail messages to internal users and relaying e-mail messages to the Internet.

Before you can create this connector, you must enable the Exchange Servers permission group.

Note:
You must perform the following steps in the order in which they are presented.

To create an externally secured connector for the custom Receive connector

1. Right-click the new connector, click Properties, click the Permissions Groups tab, and then select Exchange servers.

2. Click the Authentication tab, and then click to enable the Externally secured check box.

When you configure this setting, you will be granting several rights including the right to "send on behalf of users" in your organization, the right to ResolveP2 (make it so that the messages appear to be sent within the organization instead of anonymously). This setting also lets you bypass anti-spam filtering and size limits. The default Externally Secured permissions are as follows:

• MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Authoritative-Domain}
  
  
• MS Exchange\Externally Secured Servers {ms-Exch-Bypass-Anti-Spam}
  
  
• MS Exchange\Externally Secured Servers {ms-Exch-Bypass-Message-Size-Limit}
  
  
• MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Exch50}
  
  
• MS Exchange\Externally Secured Servers {ms-Exch-Accept-Headers-Routing}
  
  
• MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Submit}
  
  
• MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Any-Recipient}
  
  
• MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Authentication-Flag}
  
  
• MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Any-Sender}
  
  

How to Grant Anonymous Permissions to the Custom Receive Connector