Exchange has a list of permissions that are assigned to each connector based on the checkbox selection below.

enter image description here

Here are an example of some SMTP headers that are used internally (in routing) to configure how exchange behaves:


These headers are not visible in Outlook, but live in Exchange as a message is sent

enter image description here


  • What are the meanings/rights of these headers?

  • What headers aren't listed?

  • What permissions are assigned to each checkbox?


A partial answer is available here, where it describes an Exchange security feature called the Header Firewall.

The header firewall removes sensitive x-headers from messages and prevents abuse. The article describes how they are configured, but stops short of listing all the headers, the meanings of the rights, or the relationship to the checkboxes.

That being said, I'll run the following command later to enumerate the various settings for send and receive connectors.

Get-SendConnector –Identity {name of Send connector} | Get-ADPermission | where {$_.ExtendedRights –like “*routing*”} | fl user, extendedrights

Get-ReceiveConnector –Identity {name of default Receive connector} | Get-ADPermission | where {$_.extendedrights – like “*routing*”} | fl user,extendedrights

Documentation on Authentication

  • Externally Secured does not stamp any SCL X-headers on the message as an SCL of -1 would’ve bypassed Outlook’s checks. The only header this authentication type creates is X-MS-Exchange-Organization-AuthAs: Internal

Documentation on SMTP headers

  • ms-Exch-Bypass-Anti-Spam extended right circumvents the Exchange Anti-Spam checks, not Outlook’s.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.