Exchange prob - with relay not allowed

Background - we have an all NT network, this box is a win2k advanced server with exchange 2k, nothing else. I discovered E2K requires it is run on a PDC, no good for our network, so when I set up this box I made it a domain of its own, and its own PDC. This is a test box only at this point. I open outlook on another machine, set it up to use this test exchange server, compose a test email, send it to myself, it appears to be sent, no errors, but never shows up. I tried to send a message to anohter person in the company, same results. I tried to send to a person outside the company, and get Relay Not Allowed.

I have set up FreeBSD many times, it has email server built in, I can send a message from the command line or gui to anywhere, anybody, and it works. Why doesn't this pig of a program Exchange work with the default settings?

As you can tell, I'm not too happy with this whole experience. I just want/expect the #@#$@ program to work, that's all.

It appears that your trying to send your testbed E2K mail via your company connection to the internet and that your company has it's own mail service [hense its own FQDN]. What appears to be happening is that the receiving end services see that yourtrying to relay via your companies mail service [because it sees the ip address as belonging to your company and not your testbed]and is dening your testbed email [antispam measure]. I believe if you tried a noncompany internet connection your E2K mail server would work. Also your ISP DNS resolution [IP to Domain name] basically says your company NT domain belongs at that IP address. You've created a seperate domain for your E2K test bed and your ISP DNS resolution says nope doesn't belong to that address, therefore the receiving mail service says must be bogus, must be relaying so deny traffic.[antispam measure].

Why can't I submit a reply to your reply without any 'rating'? And still leave the question open? The only way to get my reply submitted was to set not acceptable. That makes no sense to me. Sorry, I'm not in the greatest of moods this morning because of the Exchange problems.

Oh for cryin out loud, ignore the above comment. Only took the server about half an hour to post my comment.

I think perhaps what you need to do, for the purposes of allowing your workstations in one domain to use an Exchange server in another domain, would be to set up a trust relationship between the two domains first. Once you've done that, you should be able to send email from your NT domain through the Win2K Exchange server. BTW, just to be sure you understand the diff, Exchange 2K does not have to run on a Win2K DC, but it has to have Active Directory, so it has to be on a Win2K domain. I runExchange in several locations on Win2K member servers that are part of a Win2K AD domain. (I can't resist the urge to "educate" - sorry. . .)

You also have to have DNS set up properly in your Win2K domain. For your purposes, the easiest thingto do would be to make sure that your Win2K DNS server is NOT set up as a root server, but only as an authoritative server for your Win2K domain (could use it for your NT domain, too, I guess, if you want to). This means you have to delete the rootentry (".") in your DNS zone. Then, you can set it up to forward to your ISP's DNS servers, so that all domain names will be properly resolved.

Hope this helps!

What I didn't explain fully is that your ISP issues you an IP address and if it's a static line like T1 or T3 or a Static DSL line, your company FQDN is resolved to that IP address. NOT your test bed domain name [which you just made up and is probably not registered]. Unlike the USPS which will deliver physical mail to an address regardless of who it's addressed to, unless there is a fowarder listed, SMTP uses Name Servers which translates the ip address to a name. You test bed is trying to send mail with its domain name [but your companies ip address] and other mail servers see that. Because relaying is a "bad" thing "spammers" relay to hide their identity, the other mail servers your test bed is trying to make a connection with say "Nope" not gonna do it.

So, try the telnet test to see if Exchange can open port 25 to send a email. open a command prompt and type telnet.exe press enter
at the telnet prompt type setlocal_echo press enter now type open25 you should see the Microsoft Exchange Mail server and version #

This means that atleast exchange can open port 25 to be able to send out email. Then for intranet email, you'll have to create a couple of dummy AD user accounts [one on the DC and one on a workstation, connect a workstation to the test bed domain and then send a intranet email to the work station, and a reply to the DC and see if that works. If your planning on migration your NT network to a W2K with AD network, thereis a whole migration package available for that.

DR's got some pieces of the puzzle - his test will definitely tell you if your Exchange server and the SMTP server on it are working correctly. As far the internal piece of the email puzzle, you need to have a trust relationship between the domains, you need to have AD accounts on your Win2K server matching the NT network user id(s) that you are using to test, and the AD accounts need to have mailboxes set up. I'm not assuming anything here - you might already have all this in place, but I'm just making sure. When you say the trust relationship is "working by default", does this mean that you have actually set up a trust relationship or only that browsing is working between the two domains. In order to send or receive email through theWin2K domain, there has to be an actual trust relationship established between the two domains so that the Win2K domain can authenticate the users from the NT domain. This is done on the NT machine in User Manager for Domains, and on the Win2K machine in AD Domains and Trusts.

It appears your internal DNS is OK, if you can browse both externally and internally. If you can also browse and ping by name on both domains to the other domain, then you're definitely OK. However, you do need to be sure that there is an MX record somewhere (either on your own DNS servers, if they are authoritative for your domain, or on your ISP's DNS servers, if they are the authoritative ones) that points back to whatever external IP address is accessible to your Exchange server. If it's behind a firewall, you need to make sure that the firewall has the SMTP port 25 open.

Does this all check out?

Read your last comment about not being able to connect via 25 remotely.

That you need to look at your firewall. Make sure your says:

From ANY tcp <=1024 to your mail server tcp 25

And a inverse rule
From mail server tcp <=1024 to ANY tcp 25

Also on the mail server, make sure you can do DNS queries (not sure if that was asked before) Just do a nslookup, set type=mx and see if you can resolve yahoo or aol.

The unable to relay means that you need to set up the domains that are able to "relay" thru your mail server.

Every mail server does what is called Relay mail. It takes a piece of e-mail and then routes it to another server.

Now if left unchecked, any domain can route thru your mailserver; that is any one can send any piece of mail to your mail server, and your mail server will deliver, regardless of where it is being sent to.

So to close this off, you stop relaying except from either A) specified domains, B)IP's or subnets.

This then tells the mail server to only accept relay requests from trusted sources. So if you have a domain called mydomain.com

You then only want mydomain.com to be able to relay thru your mail server. If you have multiple domains, you have to add those in as well.

It does not mean that you add domains where to are sending "to". You add domains that you are sending "from".

That is how you stop the relay message.

yep That's the book! and well worth the $ spent on it. Lordinfidel also makes a very good point in adding domains to send mail FROM. Not TO. Further, if you can not telnet port 25, you have a problem with your configuration. The command set local_echo is like a loopback request to Exchange to open a connection [see Chapter 2 Intergration with Microsoft Windows 2000 , page 61 Checking the SMTP service, of Kay Unkroth's MCSE Microsoft Exchange 2000 Implementation and Administration Training kit [the one you found and hopefully bought].

Suggestion, Take the bloody server off your corporate network and run it stand alone until you get a good configuration running ADDING it to the corporate domain once it's configured properly and sending email back and forth from the server Outlook to a workstation Outlook and back.

I'll also direct you to Windows & .Net magazine and Windows Exchange Magazine forums. [I'll add a comment with the URL's for them. There is one forum strickly for Exchange 2000 Servers. Good source to ask questions, get answers.

I bought the book. Now I'm going through it from the beginning, even reinstalling w2k and exchange. I haven't found the section you mention about the NT/W2K testbed. I only see info on W2K testbed.
This machine may be connected physically to the corporate network but I am giving it a differant domain name. This is the only way I have of giving it internet access.
To make sure I understand this part correctly - E2K has to be on a W2K server (not necessarily a PDC). It has to run AD. Can I make this a member server in my NT network? Seems that would make this all work becuase it would have direct access to the NT DNS server. No trusts, or other fussing around. Or maybe I'm just way off base here.
(So here I have added a comment to my initial question, not to your answer. If I try to comment on your answer I have to give it a unacceptable rating or it will not post)

I did a complete reinstall, taking default settings, of w2k and e2k and added lookout, er, outlook.
Telnet will not connect to any port, from the server itself or from a workstation.
nslookup resolves names just fine.
Trust relationships going both ways are working and verified.
I ran vbportscan.exe and it shows that port 25 is open, it's the first on the list.
When I run Outlook on the server I get an error - unable to open your default mail folders - you do not have permission to logon.
When I set up Outlook I used a test account that I set up.
I will try another test account, start a new one and see how that goes.

Thanks for the references in the book. They all refer to an existing Exchange installation on NT. We don't have that. We have an NT pdc, for email we have a Notes Domino server administered remotely from Norway (we are in the Seattle area). Upgrading the existing NT server is not an option. The section on p148 talks about upgrading from NT to W2K. I understand mixed mode installs, but it appears that AD has to be the PDC, so E2K can access the AD. Is this correct? I read on p181 "You must deploy AD in your environment if you are planning to install E2K" It goes on to talk about upgrading to W2K. It doesn't actually cover having an NT PDC with an E2K server as a member server or even a BDC.

Appears I may be making some progress - I can telnet and connect to port 25 now. Turns out the telnet service was set to start manually by default. I changed that. Connecting to 25 works. NSLookup works for most domains I tried, a few timed out. When I send a message from the telnet window to my company Notes email account it never shows up. I see in the queue in ESM a message that says to enumerate, this book doesn't cover enumerating. Another message I tried to send showed in the queue properly, and shows status queued. How long before it actually gets sent?

I opened the IIS MMC and see a big red X on the smtp properties icon. This is obviously a problem. But, smtp should work, by default, without any fussing around with anything. All I need is for one machine to be able to send out auto-response emails, no users, no incoming messages. A FreeBSD box running a default install does this with no configuration of any kind. Why can't the much more expensive Exchange? I'm frustrated and have had enough of this...

if you can telnet to open port 25 and see the exchange message and version # That's good. Next step would be to setup Outlook to use your exchange server to send mail, But to do that! you have to create a AD accout. If you log on to your your servervia the Admin accout, then just install Outlook and set it up to use the exchange server to send email. [Don't try to send Email via telnet]. if you W2K AD server with Exchange has the correct configuration [re a the W2K AD with Exchange is a seperate domain with a two way trust to your NT domain, then via Outlook, you should be able to send email to each other. If you have a hotmail account, you can try to send email from yourself via Outlook to the hotmail account to verify outbound and then reply back to check inbound.[this is a test I do myself. I can send email to my hotmail account and watch on another computer that is signed in to that account for the mail to arrive].

If you have a firewall setup between the internet or external resources and your network, the firewall HAS to allow inbound/outbound port 25 traffic from the W2K AD w/Exchange setup.Since you already have an existing mail server, you might possibly be having a conflict between them. you have to remember thatW2K AD w/Exchange is really setup to be a PDC for the domain as AD creates all the user accounts and intergrates with Exchange to automatically create a email account when the user account is created in AD.

So now I am adding an mx record to our NT DNS server. Everything I try ends up with a Cannot REgister error.

Okay, lets keep this as simple as possible.
My goal:
To have a mail server that can send auto-response messages out from a e-commerce server (integrated with MAS200 ERP server).

It does not need to accept email from the internet, and in fact shouldn't. Why this isn't working is beyond me, whether I try W2K/E2K or NT/E5.0, doesn't matter, it just won't work. The messages hang up in the queue, with host not found.

What I don't understand is why does another server (running FreeBSD) send email out to the internet, and it has had no configuration for doing this. It just works. (We used to use this server for our purpose but the MAS200 server has a problem with intermittent sending, the developers asked us to try Exchange.) I'm sure it (MAS200) will still have the same problem, I even know the exact file holding the messages, but the developers insist on us trying Exchange.

This question was closed by the author