How can I block a mass number of senders within Outlook Exchange?

Question

How can I block a mass number of senders within Outlook Exchange?

Jeff Bird 20

I have an end user receiving massive amounts of spam messages from many addresses. In fact, they have over 4000 senders sending over 17000 messages. I need to block the sending addresses in in large quantities. Is there a way for me to upload a csv file instead of entering the addresses one at a time through tha admin portal?

I was encouraged to ask on this forum because there is a PowerShell script capable of doing this; however, I am not very familliar or confident in my PowerShell skills.

Bruce Jing-MSFT 10,925 Reputation points Microsoft External Staff

2024-08-16T06:26:51.95+00:00

Hello, @Jeff Bird

It's been a long time since I've heard from you, have you solved your problem yet? Did my previous reply help you？ If it was useful, you can mark it as an answer. Thank you for your understanding and support.

Accepted answer

3 additional answers

Your answer

Bruce Jing-MSFT 10,925 Reputation points Microsoft External Staff

2024-08-16T06:26:51.95+00:00

Hello, @Jeff Bird

It's been a long time since I've heard from you, have you solved your problem yet? Did my previous reply help you？ If it was useful, you can mark it as an answer. Thank you for your understanding and support.

Answer 1

To block a mass number of senders in Outlook Exchange, you can use the following steps:

Create a Rule: Go to "Rules" under the "Home" tab, and choose "Manage Rules & Alerts."
Set Up a New Rule: Create a new rule to move emails from specific senders to the "Junk Email" folder. Use the "from people or public group" condition and add multiple senders' addresses.
Block Specific Domains: Instead of individual addresses, you can also block entire domains by entering them in the rule.
Import a Blocked Senders List: If you have a list of addresses, import them into the "Blocked Senders" list in the Junk Email settings. For further information join now

Answer 2

Rich Matheisen 47,786

Are you using Exchange as part of Office 365 or is it an on-site Exchange organization?

I haven't had anything to do with Exchange for the last ten years (retired), but I managed the e-mail system for a multi-national company for 14 years before that. Deal with spam isn't something you want to be doing on your own. I think back to the good old days before the ILOVEYOU email worm, and how straightforward handling SMTP email was. But it escalated quickly after that.

At first, the use of DNSBLs was pretty effective. But then came bot-nets, and unless the sending IP address was sending massive amount of mail from a small number of IP addresses that didn't scale very well (although it's still somewhat effective).

Trying to maintain your own spam filter is a real time drain, and usually results in blocking inoffensive messages (e.g., early attempts at using simple text matching would flag "salTWATater"). Then there was Viagra and Cialis! Read this: https://www.cockeyed.com/lessons/viagra/viagra.html

The best way to deal with spam is to use a commercial email filter. Office 365 has one. There are other reliable products as well.

This may not count as an "answer", but it's good advice. It's also opinion, so do with it what you will.

Andy David - MVP 155.5K Reputation points MVP

2024-08-13T15:36:52.18+00:00

Rich is right ( Hey Rich!) You need a anti-spam/anti-phishing solution. A block list is just chasing your tail and every list has a limit and usually its around 1024 entries
Rich Matheisen 47,786 Reputation points

2024-08-13T18:37:24.41+00:00

Hi, Andy! I see you're still a MVP. Well done, you!

After I took over the management of the email system I tried writing my own filter by updating the old (Exchange 4!) SMTP connector with information from the SMTP protocol logs and SPEWS (remember them?) with some Perl code I wrote. That cut down the spam by about 60%, but the updates weren't "real time" so that didn't last long. Then VamSoft came out with their Open Relay Filter. That worked better and didn't cost a whole lot. But, still, that was also overrun in about a year.

It took some convincing, but in 2002 I convinced the folks in the director and VP roles that we needed something much more effective (they didn't actually need that much convincing because they were getting bombarded with junk mail, as were their cohorts in Japan, Australia, Canada, Brazil, etc. -- and phishing was just starting to become a thing). I got four IronMail appliances from Cipher Trust (two in the US and two in Brussels). That was the best money the company ever spent. Spam levels dropped by about 80% using the out-of-the-box setup. They dropped more as I was able to examine the mail that was getting through (we got email in a whole bunch of languages and spammers loved to include accented characters in words that were inappropriate to the language).

Then we (the US) part of the company was sold to a company in Texas that though their spam filter was the "bees knees" (so to speak) and retired the IronMail boxes. The "new" filters 1) couldn't keep up with the e-mail volume, 2) were managed by inexperienced (with e-mail) folks, and 3) they blocked LOTS of normal email. Two years before I retired I convinced them to ditch those junky POS software. They settled on some real appliances that actually worked.

I'm just happy I don't have to deal with that stuff any longer!
Andy David - MVP 155.5K Reputation points MVP

2024-08-13T18:58:28.78+00:00

VamSoft. Now that brings back memories.
Rich Matheisen 47,786 Reputation points

2024-08-13T19:17:54.3066667+00:00

They're still in business. They keep sending me notices of their new releases! Pretty sure I received a complementary license as an Exchange MVP. I doubt it's still valid. :-)
Jeff Bird 20 Reputation points

2024-08-16T11:34:41.34+00:00

I didn't think about this tactic, but it is a good idea. I wonder if there is a limit to how many addresses can be blocked this way.

Answer 3

Bruce Jing-MSFT 10,925 Microsoft External Staff

Hi，@Jeff Bird

Thanks for posting your question in the Microsoft Q&A forum.

Depending on your requirements, you can use PowerShell to import CSV files to enable specific users to organize a large number of senders.

Here is my testing process:

First you need to connect to Exchange Online.

User's image

Take the sender's address that needs to be blocked and make a CSV file.

User's image

Import the CSV file in PowerShell, the CSV file path must not be wrong.

$BlockedSenders = Import-Csv "C:\Users\brucejing\Documents\test.csv"

User's image

The admin02 user is set up so that he cannot receive mail addressed in the CSV file.

foreach ($Sender in $BlockedSenders) {

Set-MailboxJunkEmailConfiguration -Identity "admin02" -BlockedSendersAndDomains @{Add=$Sender.BlockedSender}

}

User's image

Use PowerShell commands to check if the settings are successful.

User's image

If my answer is helpful to you, please mark it as the answer so that other users can refer to it. Thank you for your support and understanding.

Rich Matheisen 47,786 Reputation points

2024-08-14T16:01:03.15+00:00

Isn't there a limit of 1024 addresses that can be present in the BlockedSendersAndDomains property?

That's woefully inadequate to address the 4000 senders the poster wants to block.

Attempting to deal with spam mailbox-by-mailbox would be insane, even if you only added the domains and not the individual senders!

If the OP isn't using SPF and DMARC they should start doing so (at the very minimum).

Using a trusted DNSBL can have a measurable impact on inbound junk email (sometimes not a good one, though!).

Using a commercial e-mail security device that has real-time updates, and configurable thresholds for the acceptable spamminess of inbound e-mail, that throttles the number of concurrent inbound SMTP connections for each IP address, and limits the number of recipients per connection (using the RCPT commands), that looks at the SMTP FROM address and the "From:" address in the email message (if they aren't the same they're suspect), etc.

Unless the email admin is monitoring the IP addresses that are sending spam (or phishing, or whatever) from many sources IN REAL TIME, that admin is setting himself up for failure.

Just sayin'.
Jeff Bird 20 Reputation points

2024-08-16T11:32:47.76+00:00

I found where I could import the domains 20 at a time on the tenant allow/block list which is how I ended up doing it. Unfortunately, adding that many domains basically shut our email server down. I had to go back in and remove most of them and decrease my bulk threshold to 1.
Thank you for the detailed directions. I will test my ability to implement this when the opportunity arises going forward.

Answer 4

Jeff Bird 20

Thank you all for the responses. I ended up lowering my spam threshold to 1 which is moving most bulk messages into the junk folder requiring end users to monitor those folders closely in order to avoid missing expected messages.

After attempting to block most of the message sending domains (almost 4,000), the following day, there were over 500 new messages coming from new domains. Obviously, blocking them by domain would be an impossible endeavor. Even if it is possible to block that many, I don’t have the time or patience to add 500+ addresses to the block list daily.

I think a commercial filter would be best, so I am now researching those. I am using Exchange Online so hopefully there is a commercial solution out there that doesn't cost a fortune.

S. Hanani 0 Reputation points

2025-05-01T13:15:04.44+00:00

Jeff Bird, I am suffering the same flood of daily spam messages. Can you recommend the commercial solution you found?

Share via

How can I block a mass number of senders within Outlook Exchange?

3 additional answers

Your answer