mailing as alias through transport connector Exchange 2019

Question

We have one anonymous relay connector set to externally secured. Specifically there is a legacy device we need to allow to relay outside the organization. We secure the relay to the xxx.xxx.xxx.xxx/32 IP address of the device. This works great but there is an issue when mailing as an alias, the outgoing e-mail appears to be rewritten either by Exchange 2019 or by the Edge server, not sure which. The e-mail will only deliver as the default return address and not as the reply-to alias address.

This used to work fine on Exchange 2013 but isn't working the same on Exchange 2019.

I looked and found an option at M365 that allows mailing-as an alias but nothing for the on-prem 2019 server. Is this potentially an oversight in Exchange 2019 or is there a setting that affects the ability to mail as an alias through an anonymous relay connector?

Answer 1

Here's the thing, when you configure the receive connector as externally secure you are essentially treating the message as trusted and authenticated - as if the actual user logged on and sent it.
Once Exchange considers it authenticated, then it will force the proxy / alias to the default primary Reply to Address and you can't change that.

The only way to make that work for on-prem is to use an anonymous relay that is NOT externally secured.

Answer 2

Well, its not really anonymous if you are securing it externally. :)

and yes, send as any proxy is an Exchange Online thing only