Configuring a Proper SMTP Relay for Exchange On-Prem and Exchange Online Jeff Guillet, MVP | MCSM | CISSP

CONFIGURING A PROPER SMTP RELAY Overview How to setup and configure an SMTP relay properly, both on- prem and for Office 365 SMTP relays allow on-prem appliances and application servers to send s and alerts to internal and/or external users Proper configuration helps protect your organization and SMTP namespaces #ITDevConnections

CONFIGURING A PROPER SMTP RELAY Types of SMTP Relays Internal Relays – Internal s to internal users External Relays – Internal s to internal/external users Open Relays – External s that relay to other SMTP domains = BAD #ITDevConnections

CONFIGURING A PROPER SMTP RELAY On-Prem Only Customers Use on-prem Exchange servers for relay – Opportunistic TLS Use RRDNS or MX records for HA. Don't load balance. Other options: – Dedicated IIS server (usually non-TLS) – SMTP gateway (usually non-TLS) Set-TransportConfig -InternalSMTPServers #ITDevConnections

CONFIGURING A PROPER SMTP RELAY Relay via On-Prem Exchange #ITDevConnections More control Single relay source Allows external No spam filtering Opportunistic TLS 1.0+ Uses TCP 25

CONFIGURING A PROPER SMTP RELAY Hybrid Customers Use Exchange hybrid/management server – TLS by default Use RRDNS or MX records for HA. Don't load balance. Other options: – Dedicated IIS server (usually non-TLS) – SMTP gateway (usually non-TLS) – Direct to O365 (more on this later) Set-TransportConfig –InternalSMTPServers #ITDevConnections

CONFIGURING A PROPER SMTP RELAY Relay via Hybrid Server #ITDevConnections More control Single relay source Allows external Bypasses header firewall No spam filtering Uses TLS 1.0+ Uses TCP 25

CONFIGURING A PROPER SMTP RELAY Cloud-Only Customers Create an SMTP Relay – Exchange Server (Edge or Hybrid) – Dedicated IIS server (usually non-TLS) – SMTP gateway (usually non-TLS) – Or…. Direct to O365 (more on this later) Use RRDNS or MX records for HA. Don't load balance. #ITDevConnections

CONFIGURING A PROPER SMTP RELAY Configuring Relay Services 1.Configure relay namespace in internal DNS (relay.contoso.com) 2.Configure the relay – Exchange Receive/Send Connectors – SMTP gateway – IIS server 3.Identify devices and app servers that relay 4.Reconfigure devices and app servers #ITDevConnections

CONFIGURING A PROPER SMTP RELAY Configuring IIS Relay Server Works with any Windows Server Install SMTP Server feature and IIS 6.0 Manager Install SSL certificate Configure SMTP Server properties (IPs, auth, limits, TLS) Add remote domain for smtp.office365.com Restart IIS and SMTP Server Detailed steps at configure-internal-smtp-relay.htmlhttp:// configure-internal-smtp-relay.html #ITDevConnections

CONFIGURING A PROPER SMTP RELAY Relay Directly to Office 365 Best for small orgs Requires no on-prem relay Configure on-prem devices to use the tenant target address (i.e. - contoso.mail.oe.outlook.com) Important Notes: – Firewall must allow TCP 25 or 587 outbound from all devices – Devices are treated as anonymous senders unless authenticated to send through a mailbox – Does not use TLS #ITDevConnections

CONFIGURING A PROPER SMTP RELAY Relay via Client Submission #ITDevConnections Less control Multiple relay sources Allows external Requires TLS 1.0+ No spam filtering Uses TCP 587 (or 25)

CONFIGURING A PROPER SMTP RELAY Relay via Direct Send #ITDevConnections Less control Multiple relay sources Internal only No TLS Subject spam filtering Uses TCP 25 Should add IP to SPF record

CONFIGURING A PROPER SMTP RELAY Office 365 Relay Limits O365 was designed for and meant for actual people, not mass mailing software/services – Limited to 30 messages per minute, and 10,000 recipients per day ( us/library/exchange-online-limits.aspx#MessageLimits) us/library/exchange-online-limits.aspx#MessageLimits For transactional, marketing, or any other bulk , use a third-party service #ITDevConnections

CONFIGURING A PROPER SMTP RELAY Determine SMTP Talkers Download and install LogParser 2.2 ( us/download/details.aspx?id=24659) us/download/details.aspx?id=24659 Exchange 2007: – Set Logs=C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\ProtocolLog\SmtpReceive\*.log Exchange 2010/2013: – Set Logs= %ExchangeInstallPath%\TransportRoles\Logs\ProtocolLog\SmtpReceive\*.log Exchange 2016: – Set Logs=%ExchangeInstallPath%\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive\*.log Execute from Elevated CMD prompt (not PowerShell): – "%ProgramFiles(x86)%\Log Parser 2.2\LogParser.exe" "SELECT EXTRACT_PREFIX(remote-endpoint,0,':') as IP,REVERSEDNS(EXTRACT_PREFIX(remote-endpoint,0,':')) as Name,Count(*) as Hits from '%Logs%' WHERE data LIKE '%EHLO%' GROUP BY IP ORDER BY Hits DESC" -i:CSV -nSkipLines:4 -rtp:-1" #ITDevConnections

DEMO

CONFIGURING A PROPER SMTP RELAY TLS Connections What is TLS? Required for Client Submission relay and Hybrid TLS Requirements – Resolvable FQDN namespace – Third-party SSL certificate Must be valid and trusted Name must match namespace CRL must be reachable #ITDevConnections

CONFIGURING A PROPER SMTP RELAY Overview of Connectors Receive Connectors – Frontend Receive Connectors – Client facing – Hub Transport Receive Connectors - Backend – Scoping – IPs allowed to use the connector – Security – Authentication methods – Optional external relay permissions: Get-ReceiveConnector “External Relay E15MB1" | Add-ADPermission -User 'NT AUTHORITY\Anonymous Logon' -ExtendedRights MS-Exch-SMTP-Accept-Any-Recipient Send Connectors – DNS delivery – Smart hosting #ITDevConnections

CONFIGURING A PROPER SMTP RELAY SMTP Banners Set SMTP banners on all Receive Connectors – Get-ReceiveConnector | % {Set-ReceiveConnector $_.Identity -Banner "220 $_"} #ITDevConnections

CONFIGURING A PROPER SMTP RELAY Testing the Relay Telnet Client PowerShell – Send-MailMessage -From " " -to " " - Subject "PowerShell Relay Test" -Body "Testing 1-2-3" -SmtpServer ex16a CMD line utilities like POSTIE #ITDevConnections

CONFIGURING A PROPER SMTP RELAY Blacklisting Avoid at all costs Protect your corporate domain SMTP namespace and IPs – Use dedicated public IP for relaying – Use EOP for relaying – Use 3 rd party for relaying – Use dedicated relay namespace – Configure SPF / DKIM Add SMTP relay IP address to your SPF record, if necessary SPF records and DKIM – One and only one SPF record – No more than 10 lookups including referrals – SPF: records are deprecated, use TXT: records – Ignore the O365 Portal’s "important" recommendations Test O365 relaying to confirm IP is not blocked – Telnet test – How to remove #ITDevConnections

CONFIGURING A PROPER SMTP RELAY Recommendations Use Exchange servers for SMTP relays – Cloud/hybrid users – use your hybrid or management server Use SMTP Talkers script to identify devices that relay Use dedicated Receive Connectors for Internal and External relays Configure internal IP ranges as internal SMTP servers Scope relay connectors to IPs or ranges Set SMTP Banners and use Telnet for testing Always test your SMTP relays Protect your SMTP namespace #ITDevConnections

Rate This Session Now! Rate with Mobile App: Select the session from the Agenda or Speakers menus Select the Actions tab Click Rate Session Rate with Website: Register at Go to Select this session from the list and rate it Tell Us What You Thought of This Session Be Entered to WIN Prizes! #ITDevConnections