Networks

Ask something
Question Locked

Exchange 2007 Unable to Relay

0 helpful
17 replies

by techtools2

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Need an Exchange Expert today.

Running Exchange 2007 (Windows 2008 Enterprise x64), NO EDGE SERVER, SP1.

Problem: Can receive emails from external recipients (Gmail, Yahoo, etc.). Cannot Send emails back out from internal client (Outlook). Receiving the following error:

ExchangeServer.FQDN.local #550 5.7.1 Unable to relay ##

I have been researching this for 3 weeks now. I cannot see a reason why I can receive external emails, but cannot send emails out from internal.

The only thing I have to go off of is the NDR error that isn't helping me at all.

Firewall ports are open (because I'm receiving mail), IPv6 is off on server and client.

Any help is appreciated. Thanks.

17 replies

by pshiflet-24

Check your send connectors within Exchange. If you can receive but not send,this is the most likely cause. Additionally, the NDR is stating that the message is reaching your Exchange server but Exchange is denying it, so it is not reaching your firewall. Also check your DNS settings that Exchange is using and the DNS records setup (on your local DNS server) for your Exchange server.

Let me know if this helps or you have further questions.

by techtools2

Christian, thanks for responding.

DNS is set to default to what the NIC is using, and the NIC is using the the right DNS. My DNS server shows EXCHANGESERVER with the proper A record & my MX record is good.

I have one Internal send connector and one Internet send connector that I created during the initial setup. I'm going to assume it's my Internet connector that's causing the issue, but the configuration is minimal and mostly default. Do I have to add a FQDN in the "Specify the FQDN this connector will provide in response to HELO or EHLO"??

I'm real stuck at this point. I see a lot of other posts where guys fixed their issues, but I can't implement some of their fixes because theirs are based on running the Edge Transport Server, which I don't run.

Thanks Christian

by pshiflet-24

Sorry, I should have also had you check the receive connectors under Server Configuration -> Hub Transport. You should have at least 2 connectors (client and default). The client connector should only have (default settings) permissions set for Exchange Users, port 587, make sure the FQDN of your server is entered and authentication is set properly for your network. Also, when you setup Outlook for your clients, what is the server name you entered? Make sure that you used either the IP address or the local DNS name for the server. So, if you setup Outlook with your external mx record name (mail.domain.com) you need to create a DNS record on your internal DNS server to point to your Exchange server's local address. There are other issues if your external and internal domains aren't the same (domain.com and domain.local, for example, and your receive connectors need to be adjusted accordingly so it knows what domains it is responsible for). If the outbound messages are going out over the Internet and back in, they will be using the default receive connector, not the client receive connector. If this isn't clear (not a shocker, in a hurry, sorry) please let me know. Thanks.

by techtools2

When you said

"There are other issues if your external and internal domains aren't the same (domain.com and domain.local, for example, and your receive connectors need to be adjusted accordingly so it knows what domains it is responsible for). "

That is exactly the case.
So, maybe my issue lies here. Because I have my internal domain as DomainInternal.local and my host domain as DomainExternal.com.

Now, I have a DNS record for the name of my Exchange server (Exchange.DomainInternal.local), of course. And when I set up Outlook, I used that DNS name (Exchange.DomainInternal.local).

Now, my DomainExternal.com has a forward lookup zone in my DNS, and the MX record for this is MAIL.DomainExternal.com.

So, what you're telling me is that I need to configure the default receive connector for the MAIL.DomainExternal.com ???

by pshiflet-24

The part about the domains was supposed to reference the Hub Transport's accepted domains under Organization Configuration (should be your external domain, which should be the same as your email addresses). The receive connectors just need to have the proper authentication and permissions. The only reason I am curious about the receive connectors is that relay errors that I have had to deal with all started there (or were fixed there, I suppose) but were related to 3rd party apps.

From the sounds of it, your internal and external domains are completely different, not just .com vs. .local. Is that correct? Also, just to clarify, the NDRs are being generated by your server, correct?

Lastly, though I don't think it will cause relay or total send failures, have you setup a valid certificate for your server (self-signed or otherwise) and enabled it for the required services?

by cg it

if they are the same domain name and as christianshiflet pointed out, the transport hub is configured correctly.

but if the domain names are different, not just the extension, yep Exchange will throw the relay NDR every time because unlike other versions of Exchange, 2007 has the relay option turned off by default.

by techtools2

You are correct, my DomainInternal.local is completely different from my DomainExternal.com (this was because there initially wasn't a plan to bring the hosting in-house).

Also, when i do a Test-SystemHealth in Exchange Shell, I get the error about the certificate, so I will say I have not created one at all.

When I set up both the send and receive connectors, I followed a step-by-step on how to do it, so I'm sure they are correct, but will always be willing to take advice if they aren't.

Since this posting, I haven't made any changes from the current setup.

by pshiflet-24

Check out creating a self-signed certificate and enabling it for all of the services required. If that works, but you want to buy a certificate from a trusted certificate authority you will already know the syntax and such. Check out https://www.digicert.com/easy-csr/exchange2007.htm for help on cert syntax. Check out http://technet.microsoft.com/en-us/library/aa997231%28EXCHG.80%29.aspx for help enabling the cert for the services in use. I hope that helps.

by cg it

because Exchange is an Active Directory aware system. Once in Active Directory then you have to configure the transport hub as christanshiflit mentioned. If you are trying to use a different domain name than the Active Directory domain, that's relaying and well, you can relay and specify what server can relay, I don't recommend it. Relaying even if it's a closed relay, will land your network on the spam listings.

Best bet is to change the external FQDN to match the second tier domain name of the internal network. meaning the domain name is second tier and .extension if first tier.

by techtools2

Christian, I'll look into creating the certificate. Thanks for the info.

CG, Changing either of the domain names is Not an option.

Or are you saying my external domain name should be something else than .com?

i don't understand what you're saying.

by cg it

if your Active Directory domain name is mydomain.local Exchange will send emails out using mydomain.com and not throw an NDR.

but if your Active Directory domain name is mydomain.local and your FQDN is yourdomain.com, exchange will throw a relay NDR.

The domain namespace is different. With different domain namespaces, the only way to allow sending email with different domain namespaces in an Active Directory based email system is through relaying.

mydomain.com relays for yourdomain.com by default in an Active Directory environment, Exchange 2007 will not relay for different domain namespaces.

by techtools2

My Active Directory Domain name and my Host domain name (what you're referring to as the FQDN) can be different and still relay emails.

I had this setup when I worked as an IT Manager one company, where the Active Directory name was name1.local and the host name was name2.com and I was still able to relay emails back and forth, so there's no reason why I shouldn't be able to do it now. And i'm more than certain that I am not the only Admin who has had a setup like this. It is a real world reality that the internal domain name and the external domain name will be different.

Why else would Exchange 2007 ask "Accepted Domains"???

by pshiflet-24

What is currently in your accepted domains listing and how are they entered (authoritative, internal relay...)?

What I am about to tell you is a HORRIBLE idea, but it may help you figure out where the relay failure is. Setup a new receive connector like you would for a third party application as externally secured, allowing permissions for anonymous access and Exchange Servers, and only allowing connections from your PC's IP. Once that is done, test SMTP communications with telnet (http://support.microsoft.com/kb/153119) and see if you get a relay error. Then, remove that receive connector and see if the results change.

Let me know what you find.

by techtools2

The current Accepted domain is my external host domain (DomainExternal.com).

What you suggested, is something I actually did a while back, and the error I got when I did that was a Hop Count Exceeded error, which is different from the Unable to Relay error, so when I removed it, it went back to the Unable to Relay error again.

I'll go back and try this again and definitely get back to you with the info.

by pshiflet-24

If enabling relaying allows you to send externally but creates a different issue, I would work on determining the cause of that issue. Hop count errors, as I am sure you know, typically indicate a mail loop (sender a sending to sender b forwarding to sender a forwarding to sender b...). Did you try this with multiple, individual recipients on different domains? There could also be errant DNS entries that could cause this, I believe.

by cg it

pre W2007 Exchange basically allowed relaying by default. you had to manually turn it off. That behavior, if I remember correctly was turned off in W2007 Exchange. The transport hub was created to allow different domains to be allowed to send mail. Not necessarily to allow relaying. You'll see this behavior in an Enterprise environment in multi-domain networks [non contigious domain name space].

So you have to turn on relaying in Exchange 2007 which will allow you to relay mail from a different domain [non-contigious name space].

That's why your getting NDRs relays failed.

real world is that spammers use relaying and the majority of email providers don't allow it. Many of the spam filtering software will deny emails that are not sent from the originating source and those same spam filtering software have reverse lookups to check that. If your user sends email from your domain and exchange then relays it using a different domain name, whe the spam filtering software tries a reverse lookup to verify the source, the email will be rejected.

So why do it?

I'm assuming that your own Exchange server is generating the NDR failed relay, but if your getting NDRs from someone elses mail server, then they are rejecting your emails because it looks like it's coming from an open relay.

This discussion is closed to new replies.