Exchange Server Pro » Receive Connector

How to Publish POP3 Client Settings to Users with Exchange 2010 SP1

Paul Cunningham — Fri, 18 Mar 2011 12:37:06 +0000

When you are deploying POP3 for Exchange Server 2010 it is useful to have a way to publish the correct server settings that users should configure their email client to use. Exchange Server 2010 SP1 has a neat way of publishing this information in the Exchange Control Panel (in OWA).

The first thing you’ll need to know is the POP and SMTP server settings that you want clients to use. In this example we’ll use these server names:

pop.exchangeserverpro.net
smtp.exchangeserverpro.net

These names will both need public DNS records created on your DNS servers. The POP3 server name (pop.exchangeserverpro.net in this case) should also have a valid SSL certificate installed and enabled for POP with a matching name so that you can use secure POP3 access.

Checking the Client Access server in this example I can see that the X509 certificate name configured for POP3 is not the correct one I want.

[PS] C:\>Get-PopSettings | fl x*

X509CertificateName : esp-ho-ex2010a

To change it we can use the Set-POPSettings cmdlet.

[PS] C:\>Set-PopSettings -X509CertificateName pop.exchangeserverpro.net

Next we need to look at the SMTP server. On the Hub Transport server there are two Receive Connectors configured by default.

[PS] C:\>Get-ReceiveConnector

Identity                                Bindings                                Enabled
--------                                --------                                -------
ESP-HO-EX2010A\Client ESP-HO-EX2010A    {:::587, 0.0.0.0:587}                   True
ESP-HO-EX2010A\Default ESP-HO-EX2010A   {:::25, 0.0.0.0:25}                     True

It might seem logical to use the “Default ” connector because it is bound to TCP port 25 (SMTP). However is actually the “Client ” connector that is intended for this use. Here is what TechNet says about these two Receive Connectors.

Client Servername – This Receive connector accepts SMTP connections from all non-MAPI clients, such as POP and IMAP.

Default Servername – This Receive connector accepts connections from other Hub Transport servers and any Edge Transport servers you have.

The “Client ” Receive Connector is bound to TCP port 587. It is also configured by default to respond to new connections with the FQDN of the server itself.

[PS] C:\>Get-ReceiveConnector "Client ESP-HO-EX2010A" | fl fqdn

Fqdn : esp-ho-ex2010a.exchangeserverpro.net

We can change that to the desired name using the Set-ReceiveConnector cmdlet.

[PS] C:\>Set-ReceiveConnector "Client ESP-HO-EX2010A" -Fqdn smtp.exchangeserverpro.net

Now that all of the information has been gathered and the correct settings applied we can publish the information to users in Exchange Control Panel. This is what a user would normally see in ECP.

When they click on the link there are no settings displayed by default.

We can see that no external connection settings have been configured to be published.

[PS] C:\>Get-PopSettings | fl external*

ExternalConnectionSettings : {}

[PS] C:\>Get-ReceiveConnector "Client ESP-HO-EX2010A" | fl adv*

AdvertiseClientSettings : False

To publish the settings to this location we can run the following commands.

[PS] C:\>Set-PopSettings -ExternalConnectionSettings {pop.exchangeserverpro.net:995:ssl}

In the example above the port and security settings from the previous article on securing POP3 for Exchange 2010 have been used.

[PS] C:\>Set-ReceiveConnector "Client ESP-HO-EX2010A" -AdvertiseClientSettings $true

To apply the change reset IIS on the Client Access server.

[PS] C:\>iisreset

Attempting stop...
Internet services successfully stopped
Attempting start...
Internet services successfully restarted

Now when we return to the Exchange Control Panel the users can see the published settings.

Get more Exchange Server tips at ExchangeServerPro.com

How to Configure a Relay Connector for Exchange Server 2010

Paul Cunningham — Thu, 19 Aug 2010 09:00:59 +0000

In most Exchange Server 2010 environments there will be the need to allow relaying for certain hosts, devices or applications to send email via the Exchange server. This is common with multi-function devices such as network attached printer/scanners, or applications such as backup software that send email reports.

SMTP communication is handled by the Hub Transport server in an Exchange organization. The transport service listens for SMTP connections on it’s default Receive Connector. However, this connector is secured by default to not allow anonymous connections (ie, the type of connection most non-Exchange systems will be making).

You can see this in effect if you telnet to the server on port 25 and try to initiate unauthenticated SMTP communications.

220 EX3.exchangeserverpro.local Microsoft ESMTP MAIL Service ready at Wed, 18 Au
g 2010 19:42:27 +1000
helo
250 EX3.exchangeserverpro.local Hello [192.168.0.9]
mail from: somebody@hotmail.com
530 5.7.1 Client was not authenticated

For some Hub Transport servers that are internet-facing, anonymous connections may already be enabled. In those cases relay would still be denied but will behave differently than the first example.

220 EX3.exchangeserverpro.local Microsoft ESMTP MAIL Service ready at Wed, 18 Au
g 2010 20:01:44 +1000
helo
250 EX3.exchangeserverpro.local Hello [192.168.0.9]
mail from: somebody@hotmail.com
250 2.1.0 Sender OK
rcpt to: somebody@gmail.com
550 5.7.1 Unable to relay

You’ll note that relay is denied if I try to send from an @hotmail.com address to an @gmail.com address, because neither is a valid domain for the Exchange organization. But with Anonymous Users enabled on the Receive Connector I can send from an @hotmail.com address to a valid local address.

220 EX3.exchangeserverpro.local Microsoft ESMTP MAIL Service ready at Wed, 18 Au
g 2010 20:05:54 +1000
helo
250 EX3.exchangeserverpro.local Hello [192.168.0.9]
mail from: somebody@hotmail.com
250 2.1.0 Sender OK
rcpt to: alan.reid@exchangeserverpro.local
250 2.1.5 Recipient OK
data
354 Start mail input; end with .
test
.
250 2.6.0  [In
ternalId=2] Queued mail for delivery

However if I try to relay out to an external recipient, the Exchange server does not allow it.

220 EX3.exchangeserverpro.local Microsoft ESMTP MAIL Service ready at Wed, 18 Au
g 2010 20:11:27 +1000
helo
250 EX3.exchangeserverpro.local Hello [192.168.0.9]
mail from: backups@exchangeserverpro.net
250 2.1.0 Sender OK
rcpt to: alerts@managedserviceprovider.com
550 5.7.1 Unable to relay

To permit a non-Exchange server to relay mail we can create a new Receive Connector on the Hub Transport server. Launch the Exchange Management Console and navigate to Server Management, and then Hub Transport. Select the Hub Transport server you wish to create the new Receive Connector on, and from the Actions pane of the console choose New Receive Connector.

Give the new connector a name such as “Relay ” and click Next to continue.

You can leave the local network settings as is, or optionally you can use a dedicated IP address for this connector if one has already been allocated to the server. Using dedicated IP addresses for each connector is sometimes required if you need to create connectors with different authentication settings, but for a general relay connector it is not necessary to change it.

Highlight the default IP range in the remote network settings and click the red X to delete it.

Now click the Add button and enter the IP address of the server you want to allow to relay through the Exchange server. Click OK to add it and then Next to continue.

Click the New button to complete the wizard.

The Receive Connector has now been created but is not yet ready to allow the server to relay through it. Go back to the Exchange Management Console, right-click the newly created Receive Connector and choose properties.

Select the Permission Groups tab and tick the Exchange Servers box.

Select the Authentication Tab and tick the Externally Secured box.

Apply the changes and the Receive Connector is now ready for the server to relay through.

220 EX3.exchangeserverpro.local Microsoft ESMTP MAIL Service ready at Wed, 18 Au
g 2010 20:31:00 +1000
helo
250 EX3.exchangeserverpro.local Hello [192.168.0.9]
mail from: backups@exchangeserverpro.net
250 2.1.0 Sender OK
rcpt to: alerts@managedserviceprovider.com
250 2.1.5 Recipient OK
data
354 Start mail input; end with .
test
.
250 2.6.0 <924bab1e-0f07-4054-8700-d121577993b4@EX3.exchangeserverpro.local> [In
ternalId=3] Queued mail for delivery

Because the remote IP range has been secured to that single IP address, any other servers on different IP addresses still won’t be able to relay through the Exchange Server. From any other IP address not included in the remote IP range on the Receive Connector relay will be denied.

220 EX3.exchangeserverpro.local Microsoft ESMTP MAIL Service ready at Wed, 18 Au
g 2010 20:46:06 +1000
helo
250 EX3.exchangeserverpro.local Hello [192.168.0.2]
mail from: backups@exchangeserverpro.net
250 2.1.0 Sender OK
rcpt to: alerts@managedserviceprovider.com
550 5.7.1 Unable to relay

You can later add more IP addresses, IP ranges, subnets, or even add multiple IP addresses to the Receive Connector using a script if necessary.

Get more Exchange Server tips at ExchangeServerPro.com

How to Add Remote IP Addresses to Existing Receive Connectors

Paul Cunningham — Thu, 17 Dec 2009 21:00:35 +0000

The Exchange Management Shell provides the Set-ReceiveConnector cmdlet for modifying settings on Hub Transport server Receive Connectors. This can include the RemoteIPRanges setting, which is the multivalued list of IP addresses on the network that are allowed to use that Receive Connector to send mail.

Most Exchange environments will include at least one Receive Connector that is configured to allow certain hosts and applications to relay email. Over time this may build up a lengthy RemoteIPRanges IP address list. When it comes time to add additional IP addresses to the list it seems logical to use Set-ReceiveConnector, however this cmdlet will overwrite the existing setting with the new IP address specified.

For example, look at the current IP addresses:

[PS] C:\>Get-ReceiveConnector "Relay Connector" | fl remoteipranges

RemoteIPRanges : {10.0.0.21, 10.0.0.23, 10.0.0.22, 10.0.0.14, 10.0.0.20, 10.0.0.19, 10.0.0.18, 10.0.0.17, 10.0.0.16, 10
                 .0.0.15, 10.0.0.10, 10.0.0.9, 10.0.0.8, 10.0.0.7, 10.0.0.6, 10.0.0.5, 10.0.0.4, 10.0.0.13, 10.0.0.12,
                 10.0.0.11, 10.0.0.3, 10.0.0.2, 10.0.0.1}

Note: if the list of IP addresses is too long and is being truncated in the shell output see this tip for extending the enumeration limit.

Now use Set-ReceiveConnector with a new IP of 10.0.0.99:

[PS] C:\>Set-ReceiveConnector "Relay Connector" -RemoteIPRanges 10.0.0.99

And whoops, we’ve overwritten all of the previous IP addresses!

[PS] C:\>Get-ReceiveConnector "Relay Connector" | fl remoteipranges

RemoteIPRanges : {10.0.0.99}

If you were just adding one new IP address the Management Console would do the job, but that can be slow for remote servers and is not as efficient if the change is being applied to multiple servers or involves adding multiple IP addresses.

Fortunately with the Exchange Management Shell we can easily add IP addresses to existing Receive Connectors.

To add a single IP address to an existing Receive Connector:

[PS] C:\>$RecvConn = Get-ReceiveConnector "Relay Connector"
[PS] C:\>$RecvConn.RemoteIPRanges += "10.0.0.99"
[PS] C:\>Set-ReceiveConnector "Relay Connector" -RemoteIPRanges $RecvConn.RemoteIPRanges

Now we can see that 10.0.0.99 has been added to the Receive Connector.

[PS] C:\>Get-ReceiveConnector "Relay Connector" | fl remoteipranges

RemoteIPRanges : {10.0.0.99, 10.0.0.23, 10.0.0.22, 10.0.0.21, 10.0.0.1, 10.0.0.2, 10.0.0.3, 10.0.0.11, 10.0.0.12, 10.0.
                 0.13, 10.0.0.4, 10.0.0.5, 10.0.0.6, 10.0.0.7, 10.0.0.8, 10.0.0.9, 10.0.0.10, 10.0.0.15, 10.0.0.16, 10.
                 0.0.17, 10.0.0.18, 10.0.0.19, 10.0.0.20, 10.0.0.14}

To add multiple IP addresses at once use this command sequence:

[PS] C:\>$RecvConn = Get-ReceiveConnector "Relay Connector"
[PS] C:\>$RecvConn.RemoteIPRanges += "10.0.0.99", "10.0.0.100", "10.0.0.101"
[PS] C:\>Set-ReceiveConnector "Relay Connector" -RemoteIPRanges $RecvConn.RemoteIPRanges

Sometimes the list of IPs being added is too long to type out. To add multiple IP addresses from a text file called newips.txt use this command sequence instead:

[PS] C:\>$RecvConn = Get-ReceiveConnector "Relay Connector"
[PS] C:\>Get-Content .\newips.txt | foreach {$RecvConn.RemoteIPRanges += "$_"}
[PS] C:\>Set-ReceiveConnector "Relay Connector" -RemoteIPRanges $RecvConn.RemoteIPRanges

Get more Exchange Server tips at ExchangeServerPro.com

Configuring the Exchange Server 2007 Hub Transport Server

Paul Cunningham — Tue, 25 Aug 2009 18:33:42 +0000

When you install Exchange Server 2007 into an existing Exchange Organization it will import many of the relevant settings for the Hub Transport server. To begin sending and receiving email with Exchange Server 2007 we must configure Connectors.

Configure the Receive Connector

To allow the Exchange server to accept incoming email from the internet the default Receive Connector must be modified. Navigate to Server Configuration/Hub Transport. Open the properties of the default Receive Connector.

Select the Permission Groups tab and enable the Anonymous Users group. Click OK when complete.

Configure the Send Connector

Navigate to Organization Configuration/Hub Transport. In the Actions pane to the right of the Exchange Management Console click New Send Connector.

Enter a meaningful name such as Internet Email and set the intended use to Internet.

Click Next to continue.

Click the Add button and add an SMTP address space of * to route all mail to external domains over this Send Connector.

Click OK and then Next to continue.

If you route your outgoing mail via an ISP smart host or email security service choose that option and enter the IP address or DNS name of the smart host. You can add more than one smart host if necessary. Otherwise leave it configured to use DNS to route mail directly to the destination.

Click Next to continue. The Hub Transport server is automatically included as a source server for the Send Connector. Click Next to continue, then New to create the Send Connector with the chosen settings. When the Send Connector has been created successfully click Finish.

Allow the Exchange Server 2007 server to send email to the internet

Add a rule on your network’s firewall to permit the Exchange Server 2007 server to send traffic to the internet on TCP port 25. On an ISA Server 2006 firewall the process is as follows.

Open the ISA Server Management console and navigate to /Firewall Policy.

Click on Create Access Rule in the Tasks pane on the right side of the ISA Server Management Console.

Give the new Access Rule a meaningful name such as “Permit Outbound SMTP”. Click Next to continue.

Set the Rule Action to Allow. Click Next to continue.

Leave the Protocols set to “Selected protocols”. Click the Add button and choose SMTP from the Common Protocols list. Click Add again to add SMTP to the list of permitted protocols for this Access Rule.

Click Close to close the Add Protocols selection dialog, then click Next to continue.

For the Access Rule Sources click the Add button and then click New -> Computer.

Enter the name and IP address of the Exchange Server 2007 server then click OK.

In the Add Network Entities dialog navigate to Computers and select the computer object you just created. Click Add to add it to the new Access Rule, then click Close.

Now that the Exchange server is showing in the list of Access Rule Sources click Next to continue.

In the Access Rule Destinations dialog click Add, navigate to Networks select External then click Add and Close. Click Next to continue.

Leave the User Sets configured to All Users. Click Next to continue, then click Finish to close the New Access Rule Wizard.

Apply the ISA rule changes.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server Pro » Receive Connector

How to Publish POP3 Client Settings to Users with Exchange 2010 SP1

Related posts:

How to Configure a Relay Connector for Exchange Server 2010

Related posts:

How to Add Remote IP Addresses to Existing Receive Connectors

Related posts:

Configuring the Exchange Server 2007 Hub Transport Server

Configure the Receive Connector

Configure the Send Connector

Allow the Exchange Server 2007 server to send email to the internet

Related posts: