Email appliance: Rejecting internal only groups at gateway

Hi,

I have just implemented the Sophos virtual email appliance on our network to replace an older Exchange edge server.

I notice when doing recipient validation on the edge server, it used to bounce messages with a 5xx response for distribution groups that were not set as useable from the Internet.

In contrast, the email security appliance directory synchronisation feature syncs all the AD groups, whether they are available from the Internet or not, and then allows those messages through.  If the group is not available externally, the message is accepted from the hub transport server, then Exchange generates an NDR message which is then sent back to the user, giving them the fact that the email address is not available externally.  This creates backscatter and extra messages in the delivery queue for invalid domains/recipients.

Has anyone looked into this (perhaps by changing the group LDAP filter)?  I did try and research this, and came across a script to do this, but would rather get an official solution if one exists.

Thanks,

Andrew.