Re: Need help configuring Exchange Server for outgoing messages

Robarb <Robarb@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

[ snip ]

Yesterday, AT&T changed their SMTP servers to now require SSL authentication,

Are you sure they require SSL and not TLS? And that they require the
certificates to be used for authentication and not just a
userid/password (i.e. use AUTH)?

They are quite adament that they now require SSL.

When you use telnet to connect to their mail server, send "EHLO
<your-domain-name>" Do you see STARTTLS an/or TLS in the list of
keywords returned?

which Exchange Server doesn't seem to be able to do.

Exchange can use TLS, and it can use AUTH. You'll need an SSL
certificate for your machine, though.

They insist they require SSL, not TLS and I'm not sure how I would get a
certificate from them.

You don't. You get a cert from either your own CA or from a public CA
(Verisign, GoDaddy, Thawte, etc.). GoDaddy sells 'em for about $20 a
year.

If they really mean they're going to use the certificate for
authentication, find out whether they're just insisting that you
/have/ a certificate, or if the certificate name has to match your
server's name, or if the CA has to validate the cert (which would
prevent you from creating your own cert).

I still think they mean TLS and not SSL.

[ snip ]
That's actually the easy thing to do. Of course, ATT may not allow you
to use port 25 except to connect to their relay servers.

Yesterday, they told me they would unblock port 25 for my connection.

Then I guess they aren't insisting you use an encrypted connection.
:-)

I'm not sure how to configure Exchange (or MX records, etc.) to do this. Is
it difficult to set up Small Business Server 2003 to send emails without
needing an outside smtp server?

Don't know about SBS, but using a SMTP Connector is pretty easy. And
delivering email to the target servers is the default configuration.
Again, don't forget to remove the smart host stuff from your SMTP
Virtual Server.

I've tried this and the emails never get delivered. But I haven't changed
the MX or anything else in DNS.

You don't use your MX to deliver mail to other domains -- you use
theirs for that. But that doesn mean that your DNS is able to contact
other DNS servers.

Try running NSLookup from the command line on your Exchange server:
nslookup

Then enter these commands:
set q=mx
ibm.com

Do you see the IP addresses of IBM's mail servers, or do you get an
error?

If you don't host your own DNS then you'll have your ISP (ATT?) add
the MX to your DNS zone on their DNS servers.

Our DNS is Earthlink. Does the MX record matter if we're only sending from
our SBS? The POP stuff from external sources is working fine.

Your MX record is what /other/ mail servers use to find the mail
exchanger for your domain.

--
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@xxxxxxxxxxxxx
Or to these, either: mailto:h.pott@xxxxxxxxxxxxxxx mailto:melvin.mcphucknuckle@xxxxxxxxxxxxx mailto:melvin.mcphucknuckle@xxxxxxxxxxxxxxx
.

Relevant Pages

  • Re: SSL Certificate for three servers
    ... You were right it is SSL Bridging, ... It's good to hear that ISA 2004 will improve on things - I just hope it ... >> other Win2003 servers in the network behind the SBS ISA firewall. ... Now that I need to get a trusted SSL certificate for all ...
    (microsoft.public.windows.server.sbs)
  • Re: Confused about CA deployment options
    ... >3) If the servers are intranet-only, ... >> I am trying to deploy SSL in a multiple domain ... >> trust the CA. Can I use a third party certificate (i.e. ... >> clients automatically trust any certificates I then ...
    (microsoft.public.security)
  • Re: SSL Certificate for three servers
    ... The SSL cert goes on ISA and it comunicates with the ... > other Win2003 servers in the network behind the SBS ISA firewall. ... Now that I need to get a trusted SSL certificate for all ...
    (microsoft.public.windows.server.sbs)
  • SSL certificate and web farm -- How many certs do I need?
    ... I have a question about SSL certificates in relation to a ... each web server in a web farm. ... I know that you can export and import a certificate among ... one certificate and apply to all servers in the farm. ...
    (microsoft.public.inetserver.iis.security)
  • Re: SSL pages not found
    ... HTTP over SSL requires that the client send a client_hello, ... server responds with its server_hello. ... server's certificate to return. ... TLS 1.1 includes the ability for a client to specify the server name to ...
    (microsoft.public.inetserver.iis.security)