Exchange 2013 / 2016 allow anonymous relaying (sending mails without authentication to external recipients)

just a quick-and-dirty article…

In order to allow sending mails to external recipients from your internal network without authenticating against your Exchange Server, for example a scanner, you have to do two things:

1. create a receive connector (front-end-transport and internal) and specify from which IP-address(es) the connector should receive mails. For security reasons, please do not specify your entire network, or your Exchange could easily be used for sending hundreds of spam mails.
2. use the Powershell:

   Get-ReceiveConnector "NAME OF YOUR RECEIVE CONNECTOR" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "Ms-Exch-SMTP-Accept-Any-Recipient"

   on German systems you have to use „NT-Autorität\Anonymous-Anmeldung“

   

If you don’t follow the steps above you’ll get a relaying denied error.