What Exchange permissions are given to each receive connector? (Bypass SPAM, etc)

Question

Exchange has a list of permissions that are assigned to each connector based on the checkbox selection below.

Here are an example of some SMTP headers that are used internally (in routing) to configure how exchange behaves:

ms-Exch-SMTP-Accept-Authoritative-Domain
ms-Exch-Bypass-Anti-Spam
ms-Exch-Bypass-Message-Size-Limit
ms-Exch-SMTP-Accept-Exch50
ms-Exch-Accept-Headers-Routing
ms-Exch-SMTP-Submit
ms-Exch-SMTP-Accept-Any-Recipient
ms-Exch-SMTP-Accept-Authentication-Flag
ms-Exch-SMTP-Accept-Any-Sender

These headers are not visible in Outlook, but live in Exchange as a message is sent

Question

• What are the meanings/rights of these headers?

• What headers aren't listed?

• What permissions are assigned to each checkbox?

Answer 1

A partial answer is available here, where it describes an Exchange security feature called the Header Firewall.

The header firewall removes sensitive x-headers from messages and prevents abuse. The article describes how they are configured, but stops short of listing all the headers, the meanings of the rights, or the relationship to the checkboxes.

That being said, I'll run the following command later to enumerate the various settings for send and receive connectors.

Get-SendConnector –Identity {name of Send connector} | Get-ADPermission | where {$_.ExtendedRights –like “*routing*”} | fl user, extendedrights

Get-ReceiveConnector –Identity {name of default Receive connector} | Get-ADPermission | where {$_.extendedrights – like “*routing*”} | fl user,extendedrights

Documentation on Authentication

• Externally Secured does not stamp any SCL X-headers on the message as an SCL of -1 would’ve bypassed Outlook’s checks. The only header this authentication type creates is X-MS-Exchange-Organization-AuthAs: Internal

Documentation on SMTP headers

• ms-Exch-Bypass-Anti-Spam extended right circumvents the Exchange Anti-Spam checks, not Outlook’s.