How can I stop the computer name showing in Exchange 2019 SMTP connector?

In Exchange 2019, the SMTP connector (Send Connector) may expose the local computer name in the message headers, which can be undesirable for security and privacy reasons. You can take the following steps to prevent the computer name from appearing:

1. Enable Header Rewriting in Exchange

Exchange has a built-in feature called Header Firewall that allows you to remove or rewrite headers, including the Received: headers that expose the local computer name.

Steps to Configure Header Rewriting:

1. Open Exchange Management Shell (EMS) as Administrator.

   
   



2. Run the following command to check if header firewall is enabled on the Send Connector:

   
   

   Get-SendConnector | Select Name, HeaderFirewallEnabled
   

   
   



3. If the HeaderFirewallEnabled value is False, enable it by running:

   
   

   Set-SendConnector -Identity "YourSendConnectorName" -HeaderFirewallEnabled $true
   

   
   



4. Restart the Microsoft Exchange Transport service for changes to take effect:

   
   

   Restart-Service MSExchangeTransport
   

   
   

2. Remove Internal SMTP Headers with Transport Rules

You can create a Transport Rule in Exchange to strip out certain headers before sending emails externally.

Steps to Create a Transport Rule:

1. Open Exchange Admin Center (EAC).


2. Navigate to Mail flow > Rules.


3. Click New (+) > Create a new rule.


4. Set the rule name, e.g., "Remove Internal Headers".


5. Click More options (at the bottom).


6. Under Apply this rule if, choose A message header... > matches these text patterns.


7. Enter Received (or any other header you want to remove).


8. Under Do the following, choose Remove the header.


9. Click Save.

3. Modify the EHLO Response on the Receive Connector

If your Exchange server advertises its internal hostname when sending emails via SMTP, you can modify the EHLO response.

Steps to Change the SMTP Banner:

1. Open Exchange Management Shell (EMS).

   
   



2. Identify the connector you want to modify:

   
   

   Get-ReceiveConnector | Select Name, Identity, Fqdn
   

   
   



3. Modify the FQDN value of the connector:

   
   

   Set-ReceiveConnector -Identity "YourConnectorName" -Fqdn external.domain.com
   

   
   



4. Restart the Microsoft Exchange Transport service:

   
   

   Restart-Service MSExchangeTransport
   

   
   

4. Verify the Changes

After making these changes, you can test by sending an email to an external recipient and checking the email headers to confirm the local computer name is no longer present.

To Check Email Headers:

• Send a test email to an external email (e.g., Gmail or Outlook.com).


• View the email headers and look for Received: fields to ensure the internal hostname is not being exposed.

Would you like help checking your current headers to see what's still leaking?

---

I get '[PS] C:\Windows\system32>Set-ReceiveConnector -Identity "Default servername" -Fqdn mail.domain.suffix
If the AuthMechanism attribute on a Receive connector contains the value ExchangeServer, you must set the FQDN
parameter on the Receive connector to one of the following values: the FQDN of the transport server
"servername.domain.suffix", the NetBIOS name of the transport server "servername", or $null.
+ CategoryInfo : InvalidOperation: (servername\Default servername:ReceiveConnector) [Set-ReceiveConnector], Invalid
FqdnUnde...erAuthException
+ FullyQualifiedErrorId : [Server=servername,RequestId=ffc3dd81-5014-41d4-a2eb-6d96c50e07f9,TimeStamp=13/02/2025 15:25:
16] [FailureCategory=Cmdlet-InvalidFqdnUnderExchangeServerAuthException] FCFA2B6A,Microsoft.Exchange.Management.Sy
stemConfigurationTasks.SetReceiveConnector
+ PSComputerName : servername.domain.suffix'

I think that is the wrong connector - I need to change 'Default Frontend SERVER'

I took Exchange Server auth off of that and changed the connector name

If you need to change the FQDN on the Default Frontend SERVER Receive Connector, but encountered issues, follow these steps carefully:

---

Step 1: Verify the Connector Configuration

To make sure we're modifying the correct connector, run:

Get-ReceiveConnector -Identity "Default Frontend SERVER" | Format-List Name,Identity,AuthMechanism,Fqdn

• Confirm that the connector name is correct (Default Frontend SERVER in this case).


• Check if AuthMechanism includes ExchangeServer (if it does, you may need to remove it).


• Check the current Fqdn value.

---

Step 2: Remove ExchangeServer Authentication (If Necessary)

If the error persists because ExchangeServer authentication is still enabled, modify the authentication mechanisms to remove it:

Set-ReceiveConnector -Identity "Default Frontend SERVER" -AuthMechanism BasicAuth, BasicAuthRequireTLS, ExchangeAuth

Now check again with:

Get-ReceiveConnector -Identity "Default Frontend SERVER" | Format-List Name,AuthMechanism

---

Step 3: Change the FQDN

Now that ExchangeServer authentication is removed, you should be able to set the FQDN:

Set-ReceiveConnector -Identity "Default Frontend SERVER" -Fqdn "mail.domain.local"

Alternatively, if you want to remove the FQDN:

Set-ReceiveConnector -Identity "Default Frontend SERVER" -Fqdn $null

---

Step 4: Restart the Exchange Transport Service

For changes to take effect, restart the Exchange transport service:

Restart-Service MSExchangeTransport

---

Final Verification

Check if the FQDN has been successfully updated:

Get-ReceiveConnector -Identity "Default Frontend SERVER" | Select-Object Name, Fqdn

Now test sending an email and check the headers to see if the internal hostname is removed or replaced.

Let me know if you need further adjustments! 🚀

---