Preventing NDR email address information leaks for Exchange Distribution Lists

This week I had an interesting issue. Application owners were complaining that when an external sender sends email to an externally available Distribution List any NDR failures are redirected to the original sender of the message.

In this case the members of the group were confidential for external parties, yet NDRs would include email address information for the mail contacts in the group. 

The issue? When the email is unpack by exchange the return path is stamped with the sender email address.

The fix is much easier than I expected. By default, ReportToOriginatorEnabled is set to true for Distribution Lists.

The ReportToManagerEnabled and ReportToOriginatorEnabled parameters affect the return path for messages sent to the group. Some email servers reject messages that don't have a return path. Therefore, you should set one parameter to $false and one to $true, but not both to $false or both to $true. - Set-MailContact

Invert this by simply running the following on the Distribution List.

Set-DistributionGroup hr@domain.com -ReportToManagerEnabled $True -ReportToOriginatorEnabled $False

There you go….