I couldn't find a dedicated Forefront forum so I hope I'm ok to post this question here? I recently installed Forefront Protection for Sharepoint 2010 and I'm getting a lot of critical alerts in the application log on our web server when Forefront sends alert emails. The emails are being routed out through our ISP and I get plenty of different emails fine. So I dont know why some are reporting this. It looks like I simply need to change the from address to something that matches our email domain. If that's true how do I do this? I cant find the option in the management interface. The error is: Log Name: Application Source: FSEMailPickup Date: 24/02/2011 08:28:16 Event ID: 2063 Task Category: General Level: Error Keywords: Classic User: N/A Computer: VSP1.<domain>.com Description: An error occured. Mailbox name not allowed. The server response was: VSP1.server does not exist Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="FSEMailPickup" /> <EventID Qualifiers="49152">2063</EventID> <Level>2</Level> <Task>2</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2011-02-24T08:28:16.000000000Z" /> <EventRecordID>26919</EventRecordID> <Channel>Application</Channel> <Computer>Vsp1.<domain>.com</Computer> <Security /> </System> <EventData> <Data>Mailbox name not allowed. The server response was: VSP1.server does not exist</Data> </EventData> </Event> Thanks for any help...