SMTP
is a protocol that is used for sending email messages between servers.
Because most email systems that are connected to the Internet today
utilize SMTP as their messaging standard, it is important to understand
how it works with Exchange Server 2010.
Previous versions
of Exchange Server supported SMTP, but they relied on a service provided
by the underlying Windows operating system. Exchange Server 2010, on
the other hand, has its own built-in SMTP server. As a matter of fact,
the installation of Exchange Server 2010 requires that you do not have
the SMTP service already installed on your underlying Windows platform.
In Exchange Server,
for SMTP traffic to travel between computers, SMTP connectors are used.
SMTP connectors are logical representations of connections between a
source and destination server. These connectors dictate how Edge
Transport servers and Hub Transport servers communicate with each other,
with the Internet, and with previous versions of Exchange Server.
There are two types of SMTP
connector in Exchange Server 2010, Send Connectors and Receive
Connectors. Each of these types of connector represents a one-way
connection, and the configuration of the connector mandates how messages
will be transported.
To secure your
Microsoft Exchange Server 2010 environment, you must have an
understanding of these connectors and how to configure them properly.
Connector Topology
For messages to
flow between servers in an Exchange Server organization, or between the
organization and the Internet, several SMTP connectors must be in place
and properly configured. These connectors are the minimum that are
required for proper end-to-end mail flow. Table 1 lists these connectors.
Table 1. Exchange Server 2010 SMTP Connectors
Purpose | Type | How Created |
---|
Send messages between Hub Transport servers in the organization | Send | Implicit connector that is automatically computed based on the system topology. |
Send messages from a Hub Transport server to an Edge Transport server | Send | Implicit connector that is automatically computed based on the system topology. |
Send messages from an Edge Transport server to a Hub Transport server | Send | Implicit connector that is automatically created by the EdgeSync subscription process. |
Send messages from a Hub Transport server to the Internet | Send | Explicit connector that is created by the administrator and is stored in Active Directory. |
Send messages from an Edge Transport server to the Internet | Send | Explicit
connector that is either created by the administrator on an Edge
Transport server or automatically created using the EdgeSync
subscription process. |
Receive messages on a Hub Transport server from another Hub Transport server or from an Edge Transport server | Receive | Explicit
Active Directory connector that is automatically created when the Hub
Transport server role is installed. The connector is stored in Active
Directory as a child object of the server. |
Receive messages on the Edge Transport server from a Hub Transport server or from the Internet | Receive | Explicit
connector that is created automatically when the Edge Transport server
role is installed. The connector is stored in ADAM. When the Edge
Transport server is subscribed to an Active Directory site using
EdgeSync, permissions to use this connector are granted to each Hub
Transport server in the site. |
Note
Send and Receive
Connectors can be created implicitly, explicitly, or automatically. To
say that a connector is created implicitly means that it is computed
from the system topology and is not displayed in either the Exchange
Management Console or the Exchange Management Shell. A connector that is
created explicitly is one that is created when an administrator
actively performs a task. Lastly, a connector can be created
automatically during the Edge Subscription process.
Understanding Receive Connectors
SMTP
Receive Connectors serve the purpose of acting as incoming connection
points for SMTP traffic and dictate how incoming SMTP communications are
managed on an Exchange Server 2010 transport server. The Receive
Connector actively listens for incoming connections that match all
settings configured on the connector, such as connections utilizing a
particular port or from a particular IP address range.
Receive Connectors have many configurable limits that can be set, such as the following:
Number of active connections allowed
Maximum incoming message size
Maximum recipients per message
Receive Connectors are
configured on a single server and determine what particular message
traffic that server will listen for. If the Receive Connector is created
on a Hub Transport server, it is stored in Active Directory as a child
object of that server. However, when it is created on an Edge Transport
server, the connector is stored in Active Directory Lightweight
Directory Services (AD LDS), previously known as ADAM.
Understanding Send Connectors
SMTP Send Connectors are
used for relaying outgoing SMTP communications. Unlike Receive
Connectors, Send Connectors are not scoped to a single server. When an
Exchange Server 2010 server receives an SMTP message that is addressed
to a remote destination, the message is relayed to an appropriate Send
Connector that is configured to handle messages intended for that
destination.
In Active Directory
or in AD LDS, a Send Connector is created as an object in a connectors
container. A connector can have more than one source server, which is
defined as a Hub Transport server that is associated with that
connector.
For example, if a
Send Connector is configured to handle message routing to a domain that
is external to the organization, whenever a Hub Transport server
receives a message destined for that remote domain, the message is
routed to the Send Connector to be relayed appropriately.
As with Receive
Connectors, a variety of configuration settings can be defined by the
administrator. Send Connectors can be created and viewed in either the
Exchange Management Console or the Exchange Management Shell, but the
majority of the configuration must be accomplished using the Exchange
Management Shell. Send Connectors are stored in Active Directory as a
configuration object, and can be viewed from the Exchange Management
Console by going to the console tree, selecting Organization
Configuration, and then selecting Hub Transport. Next, in the results
pane, select the Send Connectors tab.
How Connectors Are Created
As
previously mentioned, connectors must exist between all messaging
servers for SMTP traffic to be passed. However, inside the Active
Directory forest, you do not have to create and configure the connectors
between Hub Transport servers. These connections are created
implicitly. This means that the connections are created by computing a
path between AD sites that is based on Active Directory site link costs.
After you install an Edge
Transport server and a Hub Transport server, the Edge Transport server
must be subscribed to an Active Directory site by using the Edge
Transport subscription process. This process enables the EdgeSync
service to establish one-way replication of recipients and configuration
details from the AD directory service to the AD LDS instance. This
subscription process can be accomplished quickly and easily by following
the steps listed on the Finalize Deployment tab on the Exchange
Management Console. To get to the Finalize Deployment tab, open the
Exchange Management Console and click on Microsoft Exchange in the
console tree.
When you subscribe the
Edge Transport server, data that is stored in Active Directory gets
replicated to the AD LDS instance located on the Edge Transport server.
Some examples of the data that gets replicated are as follows:
Connectors can be created using one of the following methods:
Explicit Active Directory Connector—
When an administrator creates a connector in the Exchange Server
organization, an explicit connector is created. This object can be
modified by the administrator and changes are replicated throughout the
organization.
Explicit AD LDS Connector—
When an administrator creates a connector on an Edge Transport server,
it is stored in AD LDS. Connectors that are created on Edge Transport
servers are scoped to a single server. An administrator can modify this
object; however, the configuration applies only to that particular
connector on that Edge Transport server only.
Implicit—
Implicit connectors are automatically computed using Active Directory
site link information and existing explicit Active Directory connectors.
This connector cannot be modified, and cannot be viewed either in
Active Directory or AD LDS. The only way to change an implicit connector
is to make a change to the system topology. When a change to the
topology is made, the connector is recomputed.
Automatic Explicit AD LDS Connector—
When you subscribe an Edge Transport server, the EdgeSync subscription
process creates an Automatic Explicit AD LDS connector inside the
Exchange Server organization. This connector is then replicated to
the AD LDS instance on the Edge Transport server. This connector cannot
be modified on the Edge Transport server, but can be modified in Active
Directory. Any changes made in Active Directory are replicated to the
Edge Transport server during routine synchronization.
Automatic Implicit AD LDS Connector—
All implicit connectors are computed from the system topology as
described previously. This applies to Automatic Implicit AD LDS
connectors as well. One or more Edge Transport servers must have access
to the information contained in this connector. This connector cannot be
modified in Active Directory; however, if a change is made to the
system topology, the connector changes resulting from the topology
change will be replicated to the Edge Transport server during routine
synchronization.
Note
For the Edge
Transport servers and the Hub Transport servers to communicate with each
other, they must be able to find each other using host resolution in
the domain name system (DNS).
Hub Transport Server Connectors
After the Hub
Transport server role has been installed on an Exchange Server 2010
server in your environment, you must configure the appropriate Send and
Receive Connectors. Until this has been accomplished, the server will be
unable to send SMTP messages to, or receive them from, the Internet.
Send Connectors are
configured in the Exchange Management Console in the Organization
Configuration node, and are stored in AD as a configuration object. The
Send Connectors must be configured so that the Hub Transport server
knows what source server to forward the message to. Bear in mind, there
can be multiple source servers configured on the connector.
Receive
Connectors, on the other hand, are configured in the Exchange Management
Console in the Server Configuration node, and are stored in AD as a
child object of the server. By default, when a Hub Transport server is
brought online, it has two default Receive Connectors already
configured.
Both Send and Receive
Connectors can be viewed and modified using the Exchange Management
Shell. As a matter of fact, many configuration settings can only be accomplished using the Exchange Management Shell.
So, SMTP Send
Connectors handle outgoing messages; SMTP Receive Connectors handle
incoming messages. For proper message flow, the Hub Transport server
must have the appropriate connectors to allow mail flow to and from the
Internet (by relaying through an Edge Transport server), as well as to
and from other Hub Transport servers.
A
Hub Transport server must have at least three required connectors to
function properly. The first two, both of which are Receive Connectors,
are created automatically during the installation of the Hub Transport
server:
A Receive
Connector that is configured to accept SMTP messages on port 25 from all
remote IP addresses. The usage type for this connector should be
“Internal” as well. This connector is automatically generated during the
installation of the Hub Transport server.
A
second Receive Connector that is configured to accept messages on port
587 from all remote IP addresses. This connector is needed to accept
SMTP connections from non-MAPI clients who are connecting through a
client access server. The usage type for this connector should be set to
“Internal.” This connector is automatically created during the
installation of the Hub Transport server.
The third required connector is a Send Connector:
By
default, no explicit Send Connector exists on the Hub Transport server,
so you must perform one of two actions to create it—either the connector
is automatically generated when you create an Edge subscription, or you
must manually configure it. After this process has been completed, your
environment will be ready to route Internet-bound messages from the Hub
Transport server to the Edge Transport server, and then out to the
Internet.
Automatic Creation of Send Connectors
To automatically
create the Send Connector, you must have a server with the Edge
Transport server role and utilize an Edge subscription and the EdgeSync
service. To do so, perform the following steps:
1. | Install the Hub Transport server role.
|
2. | On
the Edge Transport server, export the Edge subscription file. If you
have more than one Edge Transport server, each server requires a
separate subscription file. The Edge subscription file can be exported
in the Microsoft Exchange Shell utilizing the following command:
new-edgesubscription – filename "c:\server1info.xml"
|
3. | Next,
you must import the Edge subscription. This file can be accomplished
using either the Exchange Management Console or the Exchange Management
Shell. To do so using the Exchange Management Shell, run the following
command on the Hub Transport server: new-edgesubscription –filename "c:\server1info.xml" –site "default-first-site-name"
|
4. | Verify
that synchronization was successful by viewing the Event Viewer
application log and inspecting MsExchange EdgeSync events.
|
Data
replicated to AD LDS includes the Internet Send Connector. This
connector is stored in AD and the settings for it are written on the
Edge Transport server in the local AD LDS instance. The connector has
the Edge Transport server as the source server, and is configured to use
DNS MX records to automatically route messages.
Manual Creation of Send Connectors
If you decide not to use
an Edge subscription, you must manually create and configure the Send
Connector. To do so, follow these steps:
1. | Start the Exchange Management Console.
|
2. | In the console tree, expand the Organization Configuration node, and then select the Hub Transport node.
|
3. | In the action pane, click New Send Connector. The New SMTP Send Connector Wizard starts.
|
4. | On
the Introduction page, type a name for the connector, and then select
the intended usage from a drop-down box—the intended usage should be set
to Internal for this scenario because it will be sent to the Edge
Transport servers. Click Next to continue.
|
5. | On
the Address Space page, click Add, and enter * (all domains) as the
address space. Leave the Include All Subdomains check box checked, and
click OK, as shown in Figure 1. Click Next to continue.
|
6. | On
the Network Settings page, ensure the Route All Mail Through the
Following Smart Hosts option button is selected, and then click Add.
|
7. | Enter the IP address or FQDN for the Edge Transport server, click OK, and then click Next to continue.
|
8. | On
the Smart Host Security Settings page, select the Exchange Server
Authentication option button, and then click Next to continue.
|
9. | Select one or more Hub Transport servers as the source for the connector, and then click Next.
|
10. | Review the Configuration Summary, and then click New to create the connector.
|
11. | From the Completion page, click Finish.
|
12. | Now,
you must perform manual configuration of the required connectors on the
Edge Transport server. This information is covered in the next section.
|