1.3 Ensure 'Sender reputation' is configured

Information

Sender reputation filters all messages from all receive connectors on that system and only messages from external sources are filtered. External sources are defined as non-authenticated sources, which are considered anonymous internet sources.

This recommendation configures several parameters:

Enabled parameter enables or disables sender reputation on the Exchange server.

SenderBlockingEnabled parameter specifies whether sender reputation blocks senders whose sending system fails an open proxy test.

OpenProxyDetectionEnabled parameter specifies whether sender reputation tries to determine whether the sender's address is an open proxy by connecting to the originating IP address.

SrlBlockThreshold specifies the SRL rating that must be met or exceeded for sender reputation to block a sender.

Rationale:

Sender reputation is part of the Microsoft Exchange anti-spam functionality that can help with the filtering and blocking of spam messages. Malicious actors can exploit open proxy servers to send spam, launch attacks, or engage in other attacks while masking their identity. When Exchange checks if the sender is an OpenProxy this can help mitigate attacks from those types of senders.

Impact:

Some legitimate messages may be blocked if the threshold is set too high.

Warning: If a proxy server for outbound Internet access is used, the properties of the proxy server must be defined by using the ProxyServerName, ProxyServerPort, and ProxyServerType parameters.

Note: The values of OpenProxyDetectionEnabled and SenderBlockingEnabled can both be set to $true, but they both can't be set to $false. If one value is $true and the other is $false, and the $true value is changed to $false, the parameter that was previously $false will automatically change to $true.

Note #2: Open proxy server detection requires the following open outbound TCP ports: 23, 80, 1080, 1081, 3128, and 6588.

Solution

To implement the recommended state, execute the following PowerShell cmdlet:

Set-SenderReputationConfig -Enabled $true -SenderBlockingEnabled $true -OpenProxyDetectionEnabled $true -SrlBlockThreshold 6

Default Value:

SenderBlockingEnabled True

OpenProxyDetectionEnabled True

SrlBlockThreshold 7

See Also

https://workbench.cisecurity.org/benchmarks/12442

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-8a.

Plugin: Windows

Control ID: 4c87dde7956f7e161e94465eb63e28da3a8802c65b8aefd978e21206b2ef3fa5