We have about 20k distribution lists and many of them are setup to allow senders that are unauthorized so that they can accept e-mails from external senders. Recently we have had a few of them be attacked from external senders either by spoofing our address to millions of recipients and then the distribution list users get any of the responses or simply by sending undetected SPAM/malware directly to our distribution lists.

Is there a way to use "Accept Messages From" at the domain level?   I would like to say something like all e-mails from @cisco.com but do not want to create a contact for everyone that needs to send us e-mails from cisco.com.

Appreciate the feedback.

The only thing I can think of is to create a transport rule to block mail from the Internet to these groups except from recipients you define.  That could be a lot of effort, though.

Hi,

Is there any update with your issue?

Best regards,

My suggestion is Assign some user as a moderator of Distribution group. In this way we can avoid mass attack. once moderator approve, others will get that email.

Hope this info helps

Regards,

Joby

Thanks for all the input, it is appreciated.  Setting up transport rules was disliked because all e-mail would have to route through it.   Setting up modertators was disliked because it added another step to each e-mail sent.

Where we are currently at is we have set group 1 to only accept e-mail from a distribution group of senders from within the group properties and also unchecked the require all senders to be authorized.

The result is what we wanted, e-mails that are FROM senders in the approved list even though the e-mails are generated from outside of Exchange from unauthenticated senders are allowed in, if the sender/from e-mail address is not in the list, the e-mails are rejected.  My assumption was that it was one OR the other, but appears that both can be used in conjunction with each other.