Oct 06 2016 05:02 AM
Oct 06 2016 05:02 AM
We are in hybrid deployment and all mailboxes are in Exchange online. Our mx record is pointing to our 3rd part spam filter, then sent to our on premise server which again sends to Exchange online. In short it looks like this:
Sender - 3rd part spam filter - Exchange on-premise - Exchange online.
When I analyze message header I see the following in Authentication-Results (1st line of the header):
spf=none (sender IP is 220.127.116.11) smtp.mailfrom=domain.ninja; domain.mail.onmicrosoft.com; dkim=none (message not signed) header.d=none;domain.mail.onmicrosoft.com; dmarc=none action=none header.from=domain.ninja;domain.com; dkim=none (message not signed) header.d=none;
Sender IP (18.104.22.168) is our On premise exchange server external address.
smtp.mailfrom=domain.ninja is the domain that sent the message
domain.mail.onmicrosoft.com is our exchange online domain.
Is this by design that our On-premise exchange server will be seen as sender?
If so, then it means if someone is spoofing our domain it will be bypassed since sender ip is in our SPF record?
We are getting more than enough spoofing emails that are directed to our CEO and FInance director and adding SPF record doesn't seem to help.
I know DKIM and DMARC should help better against spoofing, but currently we cannot implement them, since our MX record does not point to EOP.
Oct 06 2016 07:11 AM
Oct 07 2016 01:42 AM
i still think its bad that EXO/EOP is failing on this SPF check on connecting IP and not also checking X-Origin-IP header (which should be IP of mail server sending out mail).
What if customer do not use 3rd party spam filter but still want mail to go through on-premise server(for benefits like better messagetrace) ?
That EOP blindly accepts all message arriving on-premise server is not of best security imo :)
Oct 07 2016 02:00 AM
The X-Originating-IP header doesn't contain the IP address of the original sending server, but the IP of the PC were Outlook or OWA was used to compose and send that email. EOP has no way of evaluating the IP of the initial sending server.
Exhange Online has much improved message tracking capabilities compared to Exchange on-premises.
Oct 07 2016 02:06 AM
think you are mixing between X-origin-IP and X-Orginating-IP. Last one is IP of end user.
Messagetrace in EXO is NOT better than On-premise. In EXO you can only trace message 1 week back for real time view. If you need older than 7 days, you have to wait 2-4 hours before the results are sent to your inbox.
Oct 07 2016 02:39 AM
X-Origin-IP is a custom header probably stamped by your 3rd party spam filtering solution. If you have it, then you can use it to create a transport rule in EXO to block emails where your domain is spoofed. Something like:
Oct 07 2016 02:48 AM
but i have done multiple test and even from my on-premise server at home. X-Origin-IP is IP of mail server and X-Originating IP is end user IP.
Not every mail server has these stamps. G-mail will stamp with their IPV6 in X-origin-IP.