This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(217.60000000000002, 22%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPJ%3C/text%3E%3C/svg%3E)
Hi,
In the send connectors, removing the 'ms-Exch-Send-Headers-Routing' extended rights for NT AUTHORITY\ANONYMOUS LOGON still gives the exchange server information in HELO.
Please see the attached.
Though hostname shows as unknown and Exchange server is showing in HELO.
That's expected. Removing that permission "Controls the preservation of RECEIVED headers in messages. If this permission isn't granted, all received headers are removed from messages." When you send the message externally, that last hop is not your org receiving it, its the recipient's org.
https://learn.microsoft.com/en-us/exchange/mail-flow/connectors/send-connectors?view=exchserver-2019
The header stamp showing the receiving connection between the Exchange Server and a receiving external server is not something you can control.
You can also clear the FQDN on the send connector, but I wouldnt do that. It should match a subject name on a certificate bound to SMTP and you could get mail rejected that you sending.
Hi Andy,
Many Thanks for your response. Here FQDN on the send connector is already removed.
Can we try changing the SMTP banner on the exchange servers to hide the exchange server hostname to the outside world. We also want to hide the IP address.
https://learn.microsoft.com/en-us/exchange/mail-flow/connectors/modify-smtp-banners?view=exchserver-2019
If there are any other way, please advice.
Cheers
Priya
You won't be able to hide the external IP address of the sending server - the external receiving server will stamp that in the headers and you cant prevent that . You can change the SMTP banner, but if it doesnt match a subject name on a certificate, then you wont be able to use TLS
If you wanted to completely hide the internal Exchange Server names, then I would send mail out through a SMTP gateway
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(28.799999999999997, 82%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEY%3C/text%3E%3C/svg%3E)
You can compare the header result with an old message header result that ms-Exch-Send-Headers-Routing has not been removed on connector.
Removing ms-Exch-Send-Headers-Routing will hide your internal ip address and internal host name from the header, you can see the whole testing process in this blog: https://www.alitajran.com/remove-message-header-in-exchange-server/
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi Eric,
Thanks for the article. In our send connector, we have not populated the FQDN yet. we will try updating and testing this out.
Cheers
Priya
Any updates?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(204.8, 52%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVI%3C/text%3E%3C/svg%3E)
Have a look at this tool: HeaderRewriter for Microsoft Exchange 2013/2016/2019.