The situation: some month ago we put all Exchange 2010 servers out of operation (quite late, I know), which were forwarding external messages to our Exchange 2016 farm (on premises) so far. We do not have Exchange server with the Edge server role - this role is provided by our Proofpoint gateways.
Now we recently observed a general issue with incoming (external) e-mails addressing distribution groups where some members have an Exchange forwarding to an external recipient configured: the SMTP envelope ("P1") sender is not rewritten to the internal SMTP address anymore, leading to spoofing alerts at the forwarding destination (external SMTP server). Surprisingly this is not true for traffic NOT involving a DG (that is, a message from external sender send directly to an internal recipients, who in turn has set up a redirect to another external recipient). I found for most of the DGs that I could avoid the spoofing alert by setting the DG to ReportToManagerEnabled:$true which sets the DG manager as P1 sender address. But doing this for every DG would be a cumbersome and somehow problematic solution from my point of view (thousands of DGs, not every having a manager etc).
I tried to find any hint about a behavioural change with Exchange 2013/2016 which could give an explanation here. It looks like this is now provided by the Edge server role only (resp. SRS with Exchange Online), but I am still convinced that Exchange 2010 already started to automatically rewrite sender addresses when redirecting in a proper way. For both, mailbox recipients and DGs.
I compared the transport agents for Ex 2010/2016 and tried different settings with no success (beside changing ReportToManagerEnabled).
Can anybody give a hint or explanation about what might have caused the change? Why does Exchange 2016 rewrite the sender for a mailbox recipient, but not for a distribution group anymore? Is changing ReportToManagerEnabled my only way to achieve a change here?
Thank you in advance.
Jörn
