Sophos Email customers using IP-based mailflow rule connectors must migrate to certificate-based configuration by March 31st. To see if you're affected Click Here.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 2 replies
  • Answers 1 answer
  • Subscribers 18 subscribers
  • Views 6043 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Incoming Mail Bypassing Sophos Central Email and coming direct to On Prem Exchange?

IanW82

I've migrated from PureMessage to Sophos Central Email a couple of weeks ago and I am seeing an issue with spam that I can't quite figure out. 

I updated my MX record to use the two Sophos servers, 99% of our mail is flowing inbound as expected with a number of genuine bulk and spam mail being caught in Quarantine as expected.

However, I am seeing quite a bit of junk mail coming through and completely bypassing the Sophos servers, obvious to see as the  'Received: from' value is not the Sophos server but random I.P addresses. 

I still have PureMessage running so I am able to capture them before they hit the users inboxes but how is this scenario possible?

I was concerned it was an Exchange misconfiguration but everything looks fine there.

On another note, would it be recommend to update my Exchange Receive connector to only accept mail from the Sophos servers?

Thanks



Added tags
[edited by: Raphael Alganes at 10:03 AM (GMT -7) on 29 May 2023]
  • 0

    You should turn of SMTP from any other source than Central. Thats the first lesson, to prevent this to be happen. Central should be the only peer, which should be allowed to send you Emails. 

    Maybe there are spammer, still sitting with the old MX record in their Cache and using this. 

    __________________________________________________________________________________________________________________

  • 0

    Bit of a delayed response but this is pretty normal for junk/spam to do this. Over the last 20 odd years I've seen this where the illegitimate senders just hold on to MX records which have something that responds on the end of them. Prime spamming targets.

    If you haven't already close it off, best defence.

Unfiltered HTML