Hello,

I am migrating from Exchange 2010 to Exchange 2016 and I have an issue with recipient verification on Proxmox Mail Gateway.

Environment:

- Proxmox Mail Gateway 9.1.0
- Old mail server: Exchange 2010
- New mail server: Exchange 2016 CU23
- PMG receives mail from the Internet and relays it to Exchange
- Relay domain: example.com
- PMG transport: example.com -> 192.168.10.247:25
- Use MX: No
- Verify Receivers: Yes (450)
- Before Queue Filtering: tested both No and Yes

With Exchange 2010 recipient verification worked correctly. If an external sender sent mail to a non-existing address, PMG received a 550 response from Exchange during recipient verification and rejected the message.

After migrating to Exchange 2016, PMG verifies the recipient via SMTP callout, but Exchange 2016 initially responds with:

250 2.1.5 Recipient OK

even for non-existing recipients.

Then PMG accepts/scans the message. If the message is spam, PMG may move it to spam quarantine, even though the recipient does not exist.

Example PMG log for a non-existing recipient:

2026-06-17T02:31:40 mx1 pmg-smtp-filter: SA score=13/5 ...
2026-06-17T02:31:40 mx1 pmg-smtp-filter: moved mail for <last_f@example.com> to spam quarantine
2026-06-17T02:31:40 mx1 postfix/lmtp: status=sent (250 2.5.0 OK)

On Exchange 2016 the message is later rejected internally:

FAIL ROUTING
550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup

So the message is not delivered to a wrong mailbox, but the problem is that PMG has already accepted and processed it.

This creates a possible disk space problem: an attacker could send many large spam messages to random non-existing recipients, and PMG could store them in quarantine.

I tested:

1. PMG -> Exchange 2016 Frontend port 25
Result: Exchange returns 250 Recipient OK during verification.

2. PMG -> custom Exchange HubTransport connector on port 2526, allowed only from PMG and with AnonymousUsers
Result: still 250 Recipient OK during verification.

3. PMG -> Exchange backend/default HubTransport port 2525
Result: Exchange rejects with:
530 5.7.57 SMTP; Client was not authenticated to send anonymous mail during MAIL FROM

I also configured LDAP in PMG. The LDAP profile works and PMG can see AD users and addresses. However, “Verify Receivers” seems to use SMTP recipient verification against the relay host, not LDAP recipient validation.

Questions:

1. Is there a supported way in PMG to reject recipients that do not exist in LDAP before spam quarantine/filtering?
2. Can PMG use its LDAP profile as a recipient map for relay recipient verification?
3. Is there a recommended configuration for Exchange 2016/2019 behind PMG so SMTP Verify Receivers works like it did with Exchange 2010?
4. If this is not currently possible from the GUI, is there a safe template/custom Postfix configuration recommended by Proxmox?

My goal is:
- valid recipients should be accepted and delivered to Exchange;
- invalid recipients should be rejected by PMG before quarantine;
- spam for non-existing users should not be stored in PMG quarantine.

Thank you.