The Exchange Global Recipient Count Limit must be set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-228398	EX16-MB-000540	SV-228398r879653_rule		Low

Description
Email system availability depends in part on best practice strategies for setting tuning configurations. The Global Recipient Count Limit field is used to control the maximum number of recipients that can be specified in a single message sent from this server. Its primary purpose is to minimize the chance of an internal sender spamming other recipients, since spam messages often have a large number of recipients. Spam prevention can originate from both outside and inside organizations. While inbound spam is evaluated as it arrives, controls such as this one help prevent spam that might originate inside the organization. The Recipient Count Limit is global to the Exchange implementation. Lower-level refinements are possible; however, in this configuration strategy, setting the value once at the global level facilitates a more available system by eliminating potential conflicts among multiple settings. A value of less than or equal to "5000" is probably larger than is needed for most organizations but is small enough to minimize usefulness to spammers and is easily handled by Exchange. An unexpanded distribution is handled as one recipient. Specifying "unlimited" may result in abuse.

Description

Email system availability depends in part on best practice strategies for setting tuning configurations. The Global Recipient Count Limit field is used to control the maximum number of recipients that can be specified in a single message sent from this server. Its primary purpose is to minimize the chance of an internal sender spamming other recipients, since spam messages often have a large number of recipients. Spam prevention can originate from both outside and inside organizations. While inbound spam is evaluated as it arrives, controls such as this one help prevent spam that might originate inside the organization. The Recipient Count Limit is global to the Exchange implementation. Lower-level refinements are possible; however, in this configuration strategy, setting the value once at the global level facilitates a more available system by eliminating potential conflicts among multiple settings. A value of less than or equal to "5000" is probably larger than is needed for most organizations but is small enough to minimize usefulness to spammers and is easily handled by Exchange. An unexpanded distribution is handled as one recipient. Specifying "unlimited" may result in abuse.

STIG	Date
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide	2023-09-13

Details

Check Text ( C-30631r496990_chk )
Review the Email Domain Security Plan (EDSP). Determine the global maximum message recipient count. Open the Exchange Management Shell and enter the following command: Get-TransportConfig \| Select Name, Identity, MaxRecipientEnvelopeLimit If the value of "MaxRecipientEnvelopeLimit" is not set to "5000", this is a finding. or If "MaxRecipientEnvelopeLimit" is set to an alternate value and has signoff and risk acceptance in the EDSP, this is not a finding.

Check Text ( C-30631r496990_chk )

Review the Email Domain Security Plan (EDSP).

Determine the global maximum message recipient count.

Open the Exchange Management Shell and enter the following command:

Get-TransportConfig | Select Name, Identity, MaxRecipientEnvelopeLimit

If the value of "MaxRecipientEnvelopeLimit" is not set to "5000", this is a finding.

or

If "MaxRecipientEnvelopeLimit" is set to an alternate value and has signoff and risk acceptance in the EDSP, this is not a finding.

Fix Text (F-30616r496991_fix)
Update the EDSP to specify the global maximum message recipient count. Set-TransportConfig -MaxRecipientEnvelopeLimit 5000 or Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance. Restart the Microsoft Exchange Information Store service.