Enable Recipient Filtering, for Recipient Verification in Exchange Server 2016 and 2019

Versions 2013 and earlier of exchange have reached the official End-of-Life (EOL) with Microsoft and Microsoft has ceased support for these products. The following instructions were correct at time of writing, however, as these versions are no longer officially supported, we cannot guarantee the success of configuration.

  1. Open the Exchange Management Shell on the Mail Server
  2. Enter the command:

    3. Get-TransportAgent

  3. Check for 'Recipient Filter Agent' to see if it is enabled:
    1. To install this feature, enter:

      2. & $env:ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1

    2. To enable the feature, run:

      3. Enable-TransportAgent “Recipient Filter Agent”

    3. Restart the "Microsoft Exchange Transport" service, using command:

      4. Restart-Service MSExchangeTransport

  4. Ensure your accepted domains are using Address Book to check for valid recipients. By default, this should be enabled when Exchange is an authoritative Mailbox Server for the domain
  5. Enable the recipient filter:

    6. Set-RecipientFilterConfig -RecipientValidationEnabled $true

  6. Restart the "Microsoft Exchange Transport" service, using command:

    7. Restart-Service MSExchangeTransport

  7. To set the Hub Transport receive connector to receive filtered email, and correctly validate users addresses:
    1. Issue the command:

      2. Get-ReceiveConnector | fl name,bindings

    2. Note the name of the connector with binding ending :2525 (listening on connections from port 2525)
    3. Set the receive connector to accept unauthenticated SMTP connections using command:

      4. Set-ReceiveConnector -identity '<name from step 7b.>' -PermissionGroups 'AnonymousUsers, ExchangeUsers, ExchangeServers, ExchangeLegacyServers'

  8. Restart the "Microsoft Exchange Transport" service, using command:

    9. Restart-Service MSExchangeTransport

  9. Run the following command:

    10. Set-RecipientFilterConfig -RecipientValidationEnabled $true

  10. Open port 2525 on the firewall on the MTA's public connection
  11.  
  12. Edit the route in SpamExperts (Domain Level Control Panel > Incoming > Destinations) to use port 2525 rather than port 25. See Manage Destinations