Internal messages are treated as inbound on Exchange hub server

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

Email sent by internal users is affected by content filtering policies configured for Inbound messages.

NOTE:  This article does not apply to issues with SPAM filtering. 

Cause

Exchange 2007 uses role based mail routing. Email sent to an Exchange HUB server are considered "inbound" causing the inbound rule to apply.

Resolution

Upgrade to SMSMSE 6.5.1 or higher. To download the latest release, read Obtaining an update or an upgrade for a Symantec Corporate product.
 

Workaround

Define the set of internal domains.  SMSMSE uses this list to exempt emails with these senders from being considered as inbound.

1. Open the Symantec Mail Security for Microsoft Exchange console.
2. Navigate to Admin -> System Settings.
3. Check Enable list of internal domains.
4. Enter internal domains, one per line, in the List of internal domains box.
5. Click Deploy Changes.

If you continue to see internal emails treated as inbound after setting up the list of internal domains, complete the follow steps to exempt internal email addresses from the rule:
 

1. Open the Symantec Mail Security for Microsoft Exchange console.
2. Navigate to Policies -> Content Filtering Rules
3. For each enabled content filtering rule complete the following steps:
4. Right click the rule, and select Edit rule...
5. Note whether the rule is applied to "Internal messages (store)" if it is, uncheck it if you did not want internal emails to trigger.
6. Click the Users tab
7. Change the Sender dropdown to "Apply if the sender of the message is NOT in the list"
8. In the "SMTP addresses (one per line):" box enter the *@<your domain> (for example Symantec would enter *@symantec.com). Repeat for any sub-domains/aliases you host on this server.

After implementing the changes for each of your enabled content rules, click Deploy Changes

Technical Information

Headers from a 2007 internal message will look similar to the following:

Received: from 2008DC.2007Exchange.internal ([fe80::7493:a258:e51c:58ee]) by
2008DC.2007Exchange.internal ([fe80::7493:a258:e51c:58ee%10]) with mapi; Wed,
2 Dec 2009 12:33:38 -0800

While internal message headers on 2003 are completely blank. This reveals the underlying Exchange processing change made in 2007 that triggers this behavior.
 

Applies To

• SMSMSE is installed on Exchange HUB server.
• Exchange 2007