How do I set up Exchange (2003 - 2016) to accept incoming messages only from the EuropeanMX servers?

Exchange 2003

With Microsoft Exchange 2003 it is possible to share the IP addresses responsible for delivery based on a host name. In Exchange 2003 there is a list of "domains" for this purpose, in which the host name "delivery.antispamcloud.com" can be entered instead of the root host name of your server.

Exchange 2007 - 2016

Since Microsoft has removed the ability to share incoming connections by hostname or via reverse DNS, a powershell script can help to automatically add the IP addresses to the whitelist of your Exchange Receive Connector.

Add-PSSnapin Microsoft.Exchange*
#Start
$ErrorActionPreference = "Stop"
$ips = [System.Net.Dns]::GetHostAddresses("delivery.antispamcloud.com") | select IPAddressToString
$ips = $ips | foreach-object {$_.IPAddressToString}
Set-ReceiveConnector -Identity "Default SERVERNAME" -RemoteIPRanges $ips
#End

Replace the placeholder SERVERNAME with the name of your configured receive connector. You can find this under Exchange Management Console -> Server Name -> Server Configuration - > Hub Transport.

With this script, all IP addresses for the hostname "delivery.antispamcloud.com" are automatically read and added to the whitelist of your receiving connector. You can use a task planer to perform an automated, regular query of the IP addresses. You can do this with the following command:

powershell -command "& 'C:\psscripts\exchangereceiveconnector.ps1' "

If you are using Exchange 2007 with SBS 2008, you must run the task with the following command:

PowerShell.exe -PSConsoleFile "C:\Program Files\Microsoft\Exchange Server\Bin\ExShell.Psc1" -Command ". C:\psscripts\exchangereceiveconnector.ps1

The user performing the task must be a member of the Microsoft Exchange Security Groups\Server Management group and must have the Log on as batch job permission.

If you have problems with the Powershell script, please contact us.

Optionally you can add more custom IP addresses, which you can add after the line containing foreach-object:

$ips += "192.168.1.0/24"

Make sure that you replace this IP with all IP addresses or subnets that should also have the permission to deliver directly. You can add this line for each IP/subnet you want to include.