Exchange sends out some emails without any sender email in the SMTP “MAIL FROM” command

Recently we had a peculiar case in our support system:

A user’s MultiSendcon log showed problems forwarding some of the emails to their provider smtp relay server (smarthost). The problem happened not with all emails though, making it harder to diagnose.

But we soon found out that the provider’s smtp relay rejected all emails without sender address and that the source of the sender-less emails was Exchange. But how would Exchange send out Emails without a sender address? All users in Exchange invariably have smtp sender addresses attached to their records.

Our support team first thought of spammers maybe abusing the system to send out their emails but it turned out that the server was secure and the emails were in fact coming from Exchange directly.

Further investigation then revealed that these emails were all bounce messages and that Exchange just leaves out the SMTP “mail from” command entirely or leaves out the sender address from it in these cases like this:

10/8/2013 2:12:33 PM: [incoming connection to MultiSendcon from Exchange]
10/8/2013 2:12:33 PM: “MAIL FROM:<>”
10/8/2013 2:12:33 PM: [OK response from MultiSendcon]
10/8/2013 2:12:33 PM: RCPT TO:<inboundproxy@inboundproxy.com>
10/8/2013 2:12:33 PM: [OK response from MultiSendcon]
10/8/2013 2:12:33 PM: DATA
10/8/2013 2:12:33 PM: [OK response from MultiSendcon]
10/8/2013 2:12:33 PM: [Exchange sends the actual Email]
10/8/2013 2:12:33 PM: 250 OK, message accepted for delivery as 20131008-8

The weird part obviously being the “MAIL FROM: <>”.

We didn’t find a setting in Exchange to change this but created a new version of MultiSendcon that includes a new configuration parameter: You can now set the sender email address to be used in those cases where Exchange omits it.

Now when Exchange bounces an incoming email as undeliverable MultiSendcon will insert this sender (postmaster address is best here) when forwarding the bounce message to the SMTP relay servers.