Exchange DNS Configuration for Email Delivery

Getting your DNS configured correctly for email delivery is a vital part of ensuring that Exchange works as it is designed. It not only affects your incoming email, but your ability to send email as well. The DNS settings are used by many receiving mail servers to verify that your message is not spam.
The first two parts of this page apply to any email server, the last part just to Exchange/IIS mail servers. This guide is also just concerned with the SMTP email delivery side and the DNS changes required. It does not cover DNS for OWA, ActiveSync, Outlook Anywhere/RPC over HTTPS, Autodiscover or, POP3/IMAP.
MX Records
The MX records for your domain are the most important, as they are what the rest of the Internet uses to know where to send email for your domain.
The MX record is set with the domain name management provider. This could be your ISP, a registrar or a web host. Whoever is in control of your domain name.
An MX record is made up of two parts.

1. The host. This will be something along the lines of mail.example.com and will point to an IP address. You can use a CNAME if you wish, but there isn't much point as it just slows things down.
2. The MX record itself. This points to a host. Pointing the MX record to an IP address is not valid. While it will work in some cases, you will get failures.
   The host in the MX record does not have to be in the same domain that it is serving. For example you could have the domain "example.net" with its MX records pointing to "mail.example.com". The host just needs to be valid.
   However the name used on the host does play a part with the other DNS configurations made.

If you are hosting multiple domains, then you can use the same host and MX record information for all of the domains. This will also help with reverse DNS and the name of the server (see below).
The MX weight or priority indicates which server should be used first. The lowest number is tried first. This is usually incremented in units of five. Five is the lowest, followed by ten, fifteen etc. It is very rare to see the number one.
However, be careful with the priority value. Some spammers will use the higher values on purpose, hoping that the higher numbers are backup servers without the antispam tools.
Furthermore, if you are relying on a server with a higher number to receive your email, make sure that the lower numbers are not accessible. If they initially connect then the sending server could be sat in retry mode, instead of moving on to the next server in the MX list.
Reverse DNS
Reverse DNS is also important. In many cases the reverse DNS information is used to check that your server is who it says it is. The RDNS record (also known as PTR) is attached to the IP address. As such you can only have one Reverse DNS per IP address.
Reverse DNS has to be set by the company responsible for the IP address. This is usually your ISP. They do not have to host your domain - if they tell you that the cannot set it because they aren't responsible for the domain then they are wrong. Similarly, if you are told to speak to your domain name registrar (usually because they don't host the domain) then ask to speak to someone who knows how DNS on the internet works.
If your ISP will not change the reverse DNS, which is often the case with DSL type connections or a connection that uses dynamic IP address, then you may have to look at using an SMTP Connector (Exchange 2003) or Send Connector (Exchange 2007 and higher) to ensure that your email is delivered correctly.
The reverse DNS should ideally match the MX record, and what your server has on the SMTP banner when connecting. However some companies will simply accept your email because you have a reverse DNS entry, not worrying that it doesn't match what is in the SMTP banner.
SMTP Banner - Exchange 2003
Every time your server connects to another, or a server connects to yours, it announces itself with a name. This is called the SMTP Banner.
If this name isn't valid on the Internet, then some hosts will not allow your server to deliver its email.
To set the name on an Exchange Server.

1. Open Exchange System Manager, Servers, <your server>, Protocols, SMTP.
2. Right click on the "Default SMTP Virtual Server" and choose Properties.
3. Click on the last tab "Delivery" and then the button "Advanced".
4. In the box labelled "Fully Qualified Domain Name" enter the name that your server is known as on the Internet - mail.domain.com for example.
   Do not bother with "Check DNS" as it will probably fail.
   
   
    
5. Apply/Ok out.

You can test it by opening a telnet session to port 25:

1. Open a command prompt
2. Type: telnet servername 25
   Where servername is the name of your Exchange server.
3. Press enter. You should get a response like this:
   220 mail.server.domain Microsoft ESMTP MAIL Service, Version: 6.0.2790.0 Ready at
4. Type quit to close the session.

You can find out more about doing a telnet test here.
SMTP Banner - Exchange 2007
For Exchange 2007 you need to set the FQDN on the Send Connector. The receive connector is not so important, but will mean that if you carry out the telnet test as above, a different name will appear. This is not a problem and should not affect the ability of your server to send email.
Questions
Q: I am using the POP3 Connector with SBS - do I still need to make these changes?
A: You are still sending email out via SMTP, which is what these settings most affect, so they are still valid.
Q: The ISP I collect email from via the POP3 connector is already using "mail.example.com" for my email. Can I use another name?
A: You can use any name that you like. What you need to ensure is that everything matches - the host name in DNS, the SMTP Banner, and ideally the reverse DNS.
Q: The hosts that I am using on the domain name only work outside the network, and I would like them to work inside as well. Is that possible?
Q: How can I browse our web site from inside the LAN after changing our internal DNS?
A: You need to use split DNS. This is where different results are returned on DNS queries depending on whether you are inside or outside of the LAN. More information on using split DNS can be found here.

---

What to Check When Exchange Cannot Send Email to Certain Domains

“Unable to send email to certain domains” is a top call generator for Exchange issues on SBS. Due to its nature and the fact that all domains are not affected, the problem rarely lies with the SBS server. Several factors exist outside of the server configuration that can cause delivery failure to a remote mail server. This post is meant to be a quick guide to assist you in troubleshooting some common scenarios. It is not a comprehensive guide to SMTP troubleshooting.
First of all, **BE SURE TO READ THE NDR**. This is the most readily available piece of information that you have. It will tell you which mail server issued the notification and why, often leading you to the answer or at least in the right direction.
Who generates the NDR?
If the remote server accepts our message and then finds out after the fact that it cannot be delivered to the user’s mailbox, the remote server then must generate an NDR to notify the sender of the delivery failure. An example of this could be:

Your message did not reach some or all of the intended recipients.
Subject: test
Sent: 12/6/2007 3:35 PM
The following recipient(s) could not be reached:
User1 on 12/6/2007 3:49 PM
The message could not be delivered because the recipient's mailbox is full.
<contoso.com #5.2.2>

If the remote server does not accept our mail, it will issue an SMTP error, at which point our SBS server is responsible for generating the NDR. The NDR will include the SMTP error code. Here’s an example:

Your message did not reach some or all of the intended recipients.
Subject: test
Sent: 12/6/2007 4:14 PM
The following recipient(s) could not be reached:
user1@contoso.com on 12/6/2007 4:14 PM
The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address.
<adventureworks.com #5.1.1 smtp;550 5.1.1 User unknown>

If the message sits in the queue because the SBS server cannot connect to the remote server, then SBS will issue an NDR according to the expiration timeout configured on the SMTP virtual server. An example of this could be:

Your message did not reach some or all of the intended recipients.
Subject: FW: test
Sent: 12/4/2007 9:29 AM
The following recipient(s) could not be reached:
user1@contoso.com on 12/4/2007 9:35 AM
Could not deliver the message in the time limit specified. Please retry or contact your administrator.
<SERVER1.adventureworks.local #4.4.7>

This is important because the generation of NDRs by the SBS server does not automatically mean that the issue is with SBS.
Determining possible causes of an NDR
You can view the following Technet link for NDR diagnostic codes and troubleshooting tips:
http://technet.microsoft.com/en-us/library/bb124840.aspx
Common Scenarios
The following are common scenarios we see in support calls. As stated before, this list does not cover all possibilities, but provides a guide you can use to troubleshoot your incident.

• Blacklisting
• If your server has been reported sending spam, either directly or through unauthorized relay, then your server is probably blacklisted. If so, you will need to take the appropriate steps to secure your environment and contact the individual block lists to be removed. Microsoft has no control over 3^rd party blacklists.
• You can check your server’s status in several places. Examples include http://mxtoolbox.com/blacklists.aspx and http://openrbl.org
• Some blacklists may block by entire IP address ranges. Your server may be included in the range.
• An alternative is to relay your company’s email through a 3^rd party provided smart host. Email for your domain will not originate from the blacklisted IP address.
•  Connection Filtering
• Your email domain or individual IP address may be explicitly blocked by the remote server without the use of online blacklists.
• You will need to contact that organization to find out why.
• You can relay mail through a smart host if available.
• Improper DNS resolution of Remote Server
• It is possible that the remote domain is not blocking you at all, but that you are not even connecting to the correct server in the first place.
• You may be using a forwarder with a bad MX record for the remote domain. This can be configured in both the DNS management console under the server properties and on the SMTP virtual server properties in Exchange.
• You may be hosting an improper MX record for that domain (i.e. you may have created a zone in your DNS environment to hold it)
• You may have cached an invalid response. Flush your DNS cache and try again.
• Make sure that your hosts file is clean of invalid mappings to the remote server.
• You can verify the actual MX record for the remote domain by using http://www.checkdns.net/quickcheck.aspx and http://dnsstuff.com/
• You determine the IP address you are trying to connect to either in the SMTP logs or through a netmon trace.
• Port 25 blocked at the remote site
• Test this with a telnet to the remote IP on port 25
• For information on how to do this, see: http://technet.microsoft.com/en-us/library/aa995718.aspx
• Telnet will also tell you where you are failing in the SMTP communication, assuming the issue is not regarding TCP/IP connectivity
• Maximum Transmission Unit (MTU) and Black hole Routers
• A black hole router may exist between the SBS server and the remote mail server.
• If the SBS server is sending traffic that must be fragmented, but no ICMP control packet reaches SBS to let it know, then the traffic will be dropped without our knowledge.
• This can be proven with a simple ping test: ping remoteserverip –f –l 1472
• For more information on using ping to test MTU, see: http://support.microsoft.com/default.aspx?scid=kb;EN-US;159211
• PTR Record
• If the PTR record does not point your server’s IP address to its properly registered name, certain organizations checking for this will drop your connection.
• If you are planning on hosting multiple email domains from the same Exchange server on a single public IP, make sure you are allowed by your ISP to have multiple PTR records for the same IP address. If not, then the domain missing the record may be blocked occasionally.
• PTR records are created by and typically maintained by your ISP. They own the IP address that you have been assigned and should be the first point of contact if you are having problems with a record.
• Unlike A records, PTR records are not hosted by your DNS registrar; nor are they hosted by you even if you manage your own DNS namespace.
• Web sites you can use to check your PTR record include http://www.checkdns.net/quickcheck.aspx and http://dnsstuff.com/
• Sender ID
• If you are participating in the Sender ID Framework and have registered an improperly configured SPF (Sender Policy Framework) record, then you may be rejected by any mail server that checks this.
• If you are unsure of an existing SPF record or need to create a new one for your domain, visit the Sender ID Framework SPF Record Wizard: http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard
• Grey Listing
• If your queues are building due to incompatible retry intervals with the remote mail server, try adjusting the glitch retry interval: http://technet.microsoft.com/en-us/library/aa998772.aspx

Change the Default Directory in Command Prompt

Change the Default Directory in Command Prompt by kp

To change the default directory in the Command Prompt, you can either do a change directory command or permanently modify the directory using Registry Keys. The Command Prompt directory normally shows the user's documents and settings path as the default. This can be changed manually by using the 'cd' command along with the new directory path name. For example, to change the directory to the WINDOWS folder, type: cd C:\WINDOWS\system32\ This allows you to run programs found within this directory. To permanently change the default directory, the Registry Keys needs to be modified for the Command Prompt application. To open Registry Keys, go to Start -> Run and type: regedit.exe. In the Registry Editor, locate Command Prompt under HKEY_CURRENT_USER -> Software -> Microsoft -> Command Processor. Look for a key named "Autorun." If the key doesn't exist, create one by right-clicking and choosing New -> Expandable Sting Value. Rename the key to Autorun. Right-click on Autorun to edit the string. Under Value data, enter the following: CD /d C:\WINDOWS\system32\ The path name to your directory may vary depending on your custom settings. Re-boot Command Prompt and the new default directory should be shown in the window.

What Happens When You Send Email?

 

You typed in your message and clicked on the Send button in your mailer. What happens next? How does email find its way to the final recipient?

Outgoing SMTP Server

Your Internet Service Provider has a special computer called mail server, which is responsible for collecting mail from their customers. When you click the send button, your computer connects to the mail server and transmits the message along with the list of recipients.

The message is transmitted with Simple Mail Transfer Protocol (SMTP). SMTP is a language that your mail program uses to speak to the mail server. SMTP lets your mail program specify the list of recipients and the text of the message.

The mail server that understands SMTP is frequently called Outgoing SMTP Server.

Destination SMTP Server

Your destination recipient also has an Internet Service Provider. They have a mail server too.

When your SMTP server decides that it's time to send your email, it connects to the destination mail server and transmits the message to it. They use SMTP to speak to each other. Therefore the destination mail server is frequently called Destination SMTP Server.

Destination SMTP server stores the email message until your recipient decides to check if some email arrived.

Incoming POP3 Server

When the recipient decides to check the email, his email program connects to the destination SMTP server and retrieves mail from the server. This time, they use Post Office Protocol Version 3 (POP3), which is a language used to receive mail. Therefore, this server is usually called Incoming POP3 Server.

Destination SMTP server for you is Incoming POP3 server for your recipient. When your recipient replies, the situation reverses - now your mail server becomes a Destination SMTP server from the viewpoint of the reply sender.

POP3 service is not necessary. There are other means to access mail on the destination mail server. For example, you can use Web browser to access Hotmail® or Yahoo Mail without downloading all the mail to your computer.

MX Records

One thing remains unclear. There are millions of SMTP servers all around the world. How your SMTP server knows where to send the message?

This information is stored in so called MX records. MX is not an abbreviation, it doesn't mean anything. The MX record shows which destination SMTP server must be used for the specific email address. For example, the MX record for aysoft@aysoft.com points to the server called slim.aysoft.com.

The database of MX records is maintained by a network called Domain Name Service (DNS). To get access to the MX records, you must have access to the DNS server and have a permission to retrieve MX records.

You can look up MX records for any e-mail address with special software, such as AY Spy.

Relay

As you might have noticed, there are two SMTP servers involved in sending each message. Your outbound SMTP server is working as a relay - it accepts your message and relays it to the other server.

When Internet just started, any SMTP server used to work as relays - the message used to be passed from server to server freely. As the email system got abused by spammers, fewer and fewer servers were working this way. Now all open relays are closed. The only server that will relay for you is the one given to you by your Internet Service Provider.

It is also possible to bypass all relays and send email directly to the destination server. For more details see our article about direct send.

How to Create a CON folder in Windows?

Can you create a folder named “con”, “prn”, “nul” “com1″ “com2″ “lpt1″ etc. in windows ?

The answer is NO and YES!

NO because when create a new folder and try to rename it to any one of the above specified names, you know what happens! In Windows XP the folder name automatically changes back to “New Folder” no matter you try any number of times. Where as in Windows Vista/7 when you try to rename the file you get an error message “The specified device name is invalid”.

What is the reason for this? Simple, these names represent the internal devices and hence we cannot create folders with the above names.

YES because it is still possible to create these folders using the command prompt. Here’s the instructions to create it.

1. Go to command prompt
2. Type in prompt (FOR EG. TO CREATE CON FOLDER IN E: DRIVE)

C:\>md \\.\e:\con

NOTE: “con” can be replaced by any other names such as “prn”, “nul” “com1″ “com2″ “lpt1″ etc.

3. To delete the folder use the following command

C:\>rd \\.\e:\con

NOTE: The folder can only be deleted from the command prompt.You cannot remove it by right-click delete.

Installing Active Directory Domain Services (AD-DS)

Installing Active Directory Domain Services (AD-DS)

In Windows Server 2008, unlike previous server operating Systems, there is an additional step that needs to be taken before running DCPROMO to promote the server to Domain Controller and installing Active Directory on it. This step is the installation of Active Directory Domain Services (AD-DS) role on the server. In fact, the AD-DS role is what enables the server to act as a Domain Controller, but you will still need to run DCPROMO the regular way.
AD-DS can be installed in one of 3 methods:

Method 1 – Server Manager/Initial Configuration Tasks

Roles can and should be added from Server Manager (but they can also be initiated from the Initial Configuration Tasks wizard that auto-opens the first time you log on to the server).

1. Open Server Manager by clicking the icon in the Quick Launch toolbar, or from the Administrative Tools folder.
2. Wait till it finishes loading, then click on Roles > Add Roles link.

3. In the Before you begin window, click Next.

4. In the Select Server Roles window, click to select Active Directory Domain Services, and then click Next.

5. In the Active Directory Domain Services window read the provided information if you want to, and then click Next.

6. In the Confirm Installation Selections, read the provided information if you want to, and then click Next.

7. Wait till the process completes.

8. When it ends, click Close.

9. Going back to Server Manager, click on the Active Directory Domain Services link, and note that there's no information linked to it, because the DCPROMO command has not been run yet.

10. Now you can click on the DCPROMO link, or read on.
    1. To run DCPROMO, enter the command in the Run command, or click on the DCPROMO link from Server Manager > Roles > Active Directory Domain Services.
    
    2. Depending upon the question if AD-DS was previously installed or not, the Active Directory Domain Services Installation Wizard will appear immediately or after a short while. Click Next.
    Note: The Advanced features of DCPROMO will be discussed in a future article.
    3. In the Operating System Compatibility window, read the provided information and click Next.
    
    4. In the Choosing Deployment Configuration window, click on "Create a new domain in a new forest" and click Next.
    
    5. Enter an appropriate name for the new domain. Make sure you pick the right domain name, as renaming domains is a task you will not wish to perform on a daily basis. Click Next.
    Note: Do NOT use single label domain names such as "mydomain" or similar. You MUST pick a full domain name such as "mydomain.local" or "mydomain.com" and so on. The wizard will perform checks to see if the domain name is not already in use on the local network.
    6. Pick the right forest function level. Windows 2000 mode is the default, and it allows the addition of Windows 2000, Windows Server 2003 and Windows Server 2008 Domain Controllers to the forest you're creating. Read my "Understanding Windows Server 2008 Active Directory Domain and Forest Functional Levels" article for more information on that.
    
    7. Pick the right domain function level. Windows 2000 Native mode is the default, and it allows the addition of Windows 2000, Windows Server 2003 and Windows Server 2008 Domain Controllers to the domain you're creating.
    Note: If you select "Windows Server 2008" for the forest function level, you will Not be prompted to pick a domain function level. Read more about domain and forest function levels on my "Understanding Windows Server 2008 Active Directory Domain and Forest Functional Levels" article.
    8. The wizard will perform checks to see if DNS is properly configured on the local network. In this case, no DNS server has been configured, therefore, the wizard will offer to automatically install DNS on this server.
    Note: The first DCs must also be a Global Catalog. Also, the first DCs in a forest cannot be a Read Only Domain controller.
    9. It's most likely that you'll get a warning telling you that the server has one or more dynamic IP Addresses. Running IPCONFIG /all will show that this is not the case, because as you can clearly see, I have given the server a static IP Address. So, where did this come from? The answer is IPv6. I did not manually configure the IPv6 Address, hence the warning. In a network where IPv6 is not used, you can safely ignore this warning.
    
    10. You'll probably get a warning about DNS delegation. Since no DNS has been configured yet, you can ignore the message and click Yes.
    
    11. Next, change the paths for the AD database, log files and SYSVOL folder. For large deployments, carefully plan your DC configuration to get the maximum performance. When satisfied, click Next.
    
    12. Enter the password for the Active Directory Recovery Mode. This password must be kept confidential, and because it stays constant while regular domain user passwords expire (based upon the password policy configured for the domain, the default is 42 days), it does not. This password should be complex and at least 7 characters long. I strongly suggest that you do NOT use the regular administrator's password, and that you write it down and securely store it. Click Next.
    
    13. In the Summary window review your selections, and if required, save them to an unattend answer file. When satisfied, click Next.
    
    14. The wizard will begin creating the Active Directory domain, and when finished, you will need to press Finish and reboot your computer.
    Note: You can automate the rebooting process by checking the Reboot on Completion checkbox. To automate domain controller installations, you can use an answer file or you can specify unattended installation parameters at the command line. More on that in my "Creating an Unattend Installation File for DCPROMO in Windows Server 2008" article. Note: As written in my "Installing Active Directory on Windows 2008 Server Core" article, configuring a Windows Server 2008 Server Core machine REQUIRES you to perform an automated installation of Active Directory on that server, as there is NOT DCPROMO GUI on Server Core. Your server now acts as a Domain Controller. Make sure you properly back it up. You can test functionality by using AD management tools such as Active Directory Users and Computers, examine the Event Logs, services and folders and shares that have been created.

    Links

    AD DS Installation and Removal Step-by-Step Guide


Method 2 – Servermanagercmd.exe

Servermanagercmd.exe is the command prompt equivalent of the Add Roles and Add Features wizards in Server Manager. Through the use of various command line options, you can quickly and easily add or remove features and roles to or from your server, including the AD-DS role. To install AD-DS by using Servermanagercmd.exe, simply enter the following command in the Command Prompt window:

Servermanagercmd.exe –I ADDS-Domain-Controller

Let the command run and when it finishes, AD-DS will be installed on the server.

Method 3 – Letting DCPROMO do the job

Oh yes. If you forget to install AD-DS or simply want to skip clicking on some windows, you can run DCPROMO from the Run command and before it is executed, the server will check to see if the AD-DS binaries are installed. Since they are not, they will auto-install. After you complete the Add Roles Wizard, either click the link to start the Active Directory Domain Services Installation Wizard, or close Server Manager and manually run DCPROMO from the Run command.

Running DCPROMO

After installing the AD-DS role, we need to run DCPROMO to perform the actual Active Directory database and function installation. Note: This guide assumes this is the first Domain controller in the forest, thus creating a new domain in a new forest. For a guide on how to add additional Domain Controllers to existing domains, please read my upcoming "Installing Additional Windows Server 2008 Domain Controllers in your Existing Active Directory Domain" article.

Two account in one Outlook 7

It is probably a bit easier to just create two new folders with names like Personal and Business. They can be inside the current Inbox or on the same top level as the Inbox. Click on New in the menu bar and select Folder... . You will get a dialog box that will let you name the folder and choose its location.

To create Rules to sort incoming mail ...

1) Select Rules and Alerts from the Tools menu.

3) Click on New Rule in the Rules and Alerts screen.

4) Select Start with Blank Rule in the Rules Wizard. Choose Check messages when they arrive and then click the Next button.

5) Put a check in Through the specified account in the Step 1 box. The On this machine only box will also be checked.

6) Click on specified in the Step 2 box.

7) Choose an e-mail account from the drop down list in the Account screen and click OK.

8) Click Next in the Rules Wizard.

9) Put checks in Move it to the specified folder and Stop processing more rules in the Step 1 box.

10) Click on specified next to the word folder in the Step 2 box.

11) Select the desired target folder from the list and click on "OK"

12) Click "Finish" in the Rules Wizard.

13) Click on "Apply" and then "OK" in the Rules and Alerts screen.

14) Repeat the above steps for as many accounts as needed.

You can also apply any combination of created rules to existing messages in the Inbox:

1) Select Rules and Alerts from the Tools menu.

3) Click on "Run Rules Now..." in the Rules and Alerts screen.

4) Put check marks in for the rules you wish to apply

5) Do not put a check in the sub-folders option.

6) Click on Run Now.