An email gateway accepts mail for a domain and passes it on to Exchange. If it does not know the valid addresses, it accepts everything, including mail to accounting7@company.com that never existed. Exchange rejects it, and the gateway sends a bounce to a sender who is usually forged.
What happens without validation
- Bounces. The gateway sends non-delivery reports to forged senders and ends up on block lists itself.
- Address probing. Whoever watches which addresses are accepted and which are rejected later gets a list of valid mailboxes. More in the article what is directory harvesting.
- Load. Filters and quarantine work on mail nobody can receive.
Which objects count
Deliverable addresses are in the proxyAddresses attribute. The primary address starts with SMTP:, further addresses with smtp:. Not only users carry them:
| Object | Why it counts |
|---|---|
| Users with a mailbox | the ordinary addresses |
| Disabled accounts | shared and room mailboxes are disabled users |
| Mail-enabled groups | distribution lists such as info@ or sales@ |
| Dynamic distribution groups | their own object class, easy to miss |
| Contacts | addresses that forward internally |
| Public folders | mail-enabled folders with their own address |
If you only read active users with mail, you reject shared mailboxes and distribution lists. That is the most expensive mistake in this setup, because real mail gets lost.
With several domains in a forest, query the Global Catalog over LDAPS on port 3269. It knows the addresses of all domains.
Exchange recipient filtering
Exchange has its own recipient filter, switched on with Set-RecipientFilterConfig -RecipientValidationEnabled $true. It checks at Exchange, classically on the Edge Transport server. If another vendor's gateway sits in front, the gateway has already accepted the message by then. Validation therefore has to happen at the gateway itself.
Setting it up safely
- Complete source. All objects from the table, from the whole forest, disabled accounts included.
- Check coverage. Compare per domain how many addresses the gateway knows and how many Exchange has. A domain with zero addresses must not be validated.
- Catch collapses. If a sync suddenly returns far fewer addresses, for instance because of a wrong filter, the new state must not be taken over.
- Switch off stale data. If no sync arrives for days, no validation is better than validation that rejects real recipients.
- Consider hybrid. Mailboxes in Exchange Online need their addresses from Entra ID, in-house mailboxes from AD.
How Conbool solves it
On every full run, the Conbool directory agent reads every object with an SMTP address in the whole forest through the Global Catalog, including disabled accounts, distribution lists, dynamic distribution groups, contacts and public folders. Only the completion of a run replaces the old state. If a domain drops by more than half, Conbool takes nothing over. A state without updates expires after seven days, and validation switches itself off rather than rejecting real mail.
More on the pages directory harvesting protection and email security without Entra ID, the connection in the directory documentation.
