Hi All,
i am suffering some issues in Exchange 2013, one is that we enabled BlankSenderBlocking but some logs in SMTPSend can still be found, like below,
2018-10-16T06:57:17.751Z,internet,08D633031798F54E,0,,104.47.44.33:25,*,,attempting to connect
2018-10-16T06:57:17.938Z,internet,08D633031798F54E,1,192.168.1.249:16299,104.47.44.33:25,+,,
2018-10-16T06:57:18.141Z,internet,08D633031798F54E,2,192.168.1.249:16299,104.47.44.33:25,<,"220 SN1NAM04FT027.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Tue, 16 Oct 2018 06:57:17 +0000",
2018-10-16T06:57:18.141Z,internet,08D633031798F54E,3,192.168.1.249:16299,104.47.44.33:25,>,EHLO XXXX,
2018-10-16T06:57:18.329Z,internet,08D633031798F54E,4,192.168.1.249:16299,104.47.44.33:25,<,250-SN1NAM04FT027.mail.protection.outlook.com Hello [XXXX],
2018-10-16T06:57:18.329Z,internet,08D633031798F54E,5,192.168.1.249:16299,104.47.44.33:25,<,250-SIZE 49283072,
2018-10-16T06:57:18.329Z,internet,08D633031798F54E,6,192.168.1.249:16299,104.47.44.33:25,<,250-PIPELINING,
2018-10-16T06:57:18.329Z,internet,08D633031798F54E,7,192.168.1.249:16299,104.47.44.33:25,<,250-DSN,
2018-10-16T06:57:18.329Z,internet,08D633031798F54E,8,192.168.1.249:16299,104.47.44.33:25,<,250-ENHANCEDSTATUSCODES,
2018-10-16T06:57:18.329Z,internet,08D633031798F54E,9,192.168.1.249:16299,104.47.44.33:25,<,250-STARTTLS,
2018-10-16T06:57:18.329Z,internet,08D633031798F54E,10,192.168.1.249:16299,104.47.44.33:25,<,250-8BITMIME,
2018-10-16T06:57:18.329Z,internet,08D633031798F54E,11,192.168.1.249:16299,104.47.44.33:25,<,250-BINARYMIME,
2018-10-16T06:57:18.329Z,internet,08D633031798F54E,12,192.168.1.249:16299,104.47.44.33:25,<,250-CHUNKING,
2018-10-16T06:57:18.329Z,internet,08D633031798F54E,13,192.168.1.249:16299,104.47.44.33:25,<,250 SMTPUTF8,
2018-10-16T06:57:18.329Z,internet,08D633031798F54E,14,192.168.1.249:16299,104.47.44.33:25,>,STARTTLS,
2018-10-16T06:57:18.517Z,internet,08D633031798F54E,15,192.168.1.249:16299,104.47.44.33:25,<,220 2.0.0 SMTP server ready,
2018-10-16T06:57:18.517Z,internet,08D633031798F54E,16,192.168.1.249:16299,104.47.44.33:25,*,,Sending certificate
2018-10-16T06:57:18.517Z,internet,08D633031798F54E,17,192.168.1.249:16299,104.47.44.33:25,*,"XXXX",Certificate subject
2018-10-16T06:57:18.517Z,internet,08D633031798F54E,18,192.168.1.249:16299,104.47.44.33:25,*,"XXXX",Certificate issuer name
2018-10-16T06:57:18.517Z,internet,08D633031798F54E,19,192.168.1.249:16299,104.47.44.33:25,*,18000000073AE206A4A4035CFF000000000007,Certificate serial number
2018-10-16T06:57:18.517Z,internet,08D633031798F54E,20,192.168.1.249:16299,104.47.44.33:25,*,B4C98EBE5B8711B4CF1C2E376B4513B343F8ED22,Certificate thumbprint
2018-10-16T06:57:18.517Z,internet,08D633031798F54E,21,192.168.1.249:16299,104.47.44.33:25,*,XXXX;AutoDiscover.GZ-SPI.COM;CH1;GZ-SPI.COM;58.63.56.194;192.168.1.245;MB;owa.gz-spi.com,Certificate alternate names
2018-10-16T06:57:18.923Z,internet,08D633031798F54E,22,192.168.1.249:16299,104.47.44.33:25,*,,Received certificate
2018-10-16T06:57:18.923Z,internet,08D633031798F54E,23,192.168.1.249:16299,104.47.44.33:25,*,73B89750FA406F7D4F7E43A9355A9D271079E938,Certificate thumbprint
2018-10-16T06:57:18.923Z,internet,08D633031798F54E,24,192.168.1.249:16299,104.47.44.33:25,>,EHLO XXXX,
2018-10-16T06:57:22.954Z,internet,08D633031798F54E,25,192.168.1.249:16299,104.47.44.33:25,<,250-SN1NAM04FT027.mail.protection.outlook.com Hello [XXXX],
2018-10-16T06:57:22.954Z,internet,08D633031798F54E,26,192.168.1.249:16299,104.47.44.33:25,<,250-SIZE 49283072,
2018-10-16T06:57:22.954Z,internet,08D633031798F54E,27,192.168.1.249:16299,104.47.44.33:25,<,250-PIPELINING,
2018-10-16T06:57:22.954Z,internet,08D633031798F54E,28,192.168.1.249:16299,104.47.44.33:25,<,250-DSN,
2018-10-16T06:57:22.954Z,internet,08D633031798F54E,29,192.168.1.249:16299,104.47.44.33:25,<,250-ENHANCEDSTATUSCODES,
2018-10-16T06:57:22.954Z,internet,08D633031798F54E,30,192.168.1.249:16299,104.47.44.33:25,<,250-8BITMIME,
2018-10-16T06:57:22.954Z,internet,08D633031798F54E,31,192.168.1.249:16299,104.47.44.33:25,<,250-BINARYMIME,
2018-10-16T06:57:22.954Z,internet,08D633031798F54E,32,192.168.1.249:16299,104.47.44.33:25,<,250-CHUNKING,
2018-10-16T06:57:22.954Z,internet,08D633031798F54E,33,192.168.1.249:16299,104.47.44.33:25,<,250 SMTPUTF8,
2018-10-16T06:57:22.954Z,internet,08D633031798F54E,34,192.168.1.249:16299,104.47.44.33:25,*,,sending message with RecordId 121869697024043 and InternetMessageId <XXXX>
2018-10-16T06:57:22.954Z,internet,08D633031798F54E,35,192.168.1.249:16299,104.47.44.33:25,>,MAIL FROM:<> SIZE=11709,
2018-10-16T06:57:22.954Z,internet,08D633031798F54E,36,192.168.1.249:16299,104.47.44.33:25,>,RCPT TO:<XXXX>,
2018-10-16T06:57:23.189Z,internet,08D633031798F54E,37,192.168.1.249:16299,104.47.44.33:25,<,250 2.1.0 Sender OK,
2018-10-16T06:57:23.189Z,internet,08D633031798F54E,38,192.168.1.249:16299,104.47.44.33:25,<,250 2.1.5 Recipient OK,
2018-10-16T06:57:23.189Z,internet,08D633031798F54E,39,192.168.1.249:16299,104.47.44.33:25,>,BDAT 6715 LAST,
2018-10-16T06:57:25.220Z,internet,08D633031798F54E,40,192.168.1.249:16299,104.47.44.33:25,<,"250 2.6.0 <XXXX> [InternalId=14401025411291, Hostname=SN1NAM04HT164.eop-NAM04.prod.protection.outlook.com]
12325 bytes in 0.142, 84.476 KB/sec Queued mail for delivery",
2018-10-16T06:57:25.220Z,internet,08D633031798F54E,41,192.168.1.249:16299,104.47.44.33:25,>,QUIT,
2018-10-16T06:57:25.423Z,internet,08D633031798F54E,42,192.168.1.249:16299,104.47.44.33:25,<,221 2.0.0 Service closing transmission channel,
2018-10-16T06:57:25.423Z,internet,08D633031798F54E,43,192.168.1.249:16299,104.47.44.33:25,-,,Local
checked in EMS as below result,
[PS] C:\Windows\system32>Get-TransportConfig | Format-List InternalSMTPServers
InternalSMTPServers : {192.168.1.245, 192.168.1.249}
[PS] C:\Windows\system32>Get-SenderFilterConfig | Format-List Enabled
Enabled : True
[PS] C:\Windows\system32>Get-SenderFilterConfig | Format-List BlankSenderBlockingEnabled
BlankSenderBlockingEnabled : True
could anyone help on this? Thanks.
Best Regards,
Liang Zhihua