SUMMARY

How to block specific sender addresses.

DETAIL

One of the difficulties in blocking e-mail addresses is that there are actually two sender addresses associated with a message. One address is contained inside the headers of the message (i.e. in the message content itself, on the From header line). The other address is the one that the remote mail client or server sends in the SMTP conversation and is known as the envelope sender. The envelope information can be seen by reviewing the SMTP logs noting the MAIL FROM: commands in the logs. Or, in a received email, it will be the email address in the Return-Path header item. Blocking of an email based on the sender email address can be done either using the global filters, with a criteria of checking the From and CC addresses, or at the mailbox level, where users can block domains or addresses via their webmail options.

A special kind of sender can also be used in the MAIL FROM command. This is called a null sender and is represented by no sender address (which looks like <> in the SMTP conversation). Null senders are used for system generated messages, such as delivery failures.

There is a Windows registry key which can be enabled to block these null senders, but it is not advised to enable, as it will affect delivery of system generated messages, and may lead you to be blocked by remote servers. There may be some cases where you need to block them, so the registry key is:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mail Enable\Mail Enable\Connectors\SMTP
"Block null senders"=dword:00000001

Restart the SMTP service when changing or adding this registry key.

MORE INFORMATION

Tracking message path and sender location: Article ME020338