Exchange server - delivery to alternate recipient

[Chris Bedford]

My client has internal e-mail handled by an Exchange 5.0 server (Hmmm... old, yes, but it works!) Some of the users have Internet e-mail addresses as well, POP3 mailboxes handled externally by an ISP. Outlook clients connect separately to Exchange and POP3 servers and do separate mail transfers.

I have set up an Alternate Recipient for one mobile user who doesn't want to dial in to the exchange server for internal mail. This recipient is a "forward" to that user's POP3 mailbox.

When mail is sent to the internal mailbox, Exchange Server successfully forwards to the external POP3 mailbox... but only if the sender has a valid e-mail address. If the sender is not one of the privileged few with a mailbox at the ISP, the ISP's SMTP server rejects the connection "550 invalid user" or words to that effect (Anti-relaying).

This defeats the purpose of having an internal mail server, which was to enable those who don't need e-mail contact outside the company to communicate with everyone else in the company.

Is there a way that forwarded mails can be sent using one generic set of credentials, e.g. the Administrator's e-mail address? After all, the mail HAS TO originate within the company to get as far as the Exchange mailbox in the first place, before the "deliver to alternate" rule kicks in...

Any thoughts, suggestions, workarounds would be appreciated!

[Rune J. Winje]

Look at:
http://www.microsoft.com/technet/security/prodtech/mailexch/excrelay.mspx

This is for 5.5 so don't know if it is accurate for 5.0

Anyway if I read your problem description correct it sounds like your ISP's mail server is not allowing relay unless the mail is destined for a local ISP-defined mailbox.

If this is the case then it depends on the type of mail-server the ISP uses and if it can do any of the options listed under "To allow some kinds of relaying" in the link above.

Also it is a bit unclear if your Exchange 5.0 SMTP/IMC is set to forward all mail to the ISP's SMTP server (smart host) or if the Exchange 5.0 server uses DNS to deliver mail.

The easiest option is usually opening up for some defined IP-ranges that cover your POP3 clients. However IP-addresses can be spoofed, so this is not bulletproof in preventing spam. Combining with a dedicated Anti-spam server for SMTP may therefore be the best option. Symantec and Trend have good products here.


Cheers,
Rune

[Chris Bedford]

Thanks Rune -- The article refers to mail received at the Exchange server for sending-on; in this case the Exch machine is not receiving (smtp) mail at all, only internal exchange clients.

It makes no difference whether I use DNS to deliver mail, or "relay" to a smart host; the only mail that I want to forward, is to our ISP's server for delivery to our user's mailbox. Either way, Exchange connects to the same server and I get the same result.

I just find it strange that the ISP's smtp does this kind of authentication, come to think of it. If we had been using ETRN, the ISP would not have any record of specific mailboxes, so anyone should be able to send out mail regardless...

[David Borojevic]

It may be that the "redirection" that you have done in Exchange System Manager (I assume that is what you have done?) results in a message that the ISP believes is a relay. Normally if the host receives a message that is addressed to a valid mailbox in its domain then it isn't a relay by definition??? It would be interesting to see the headers of the redirected message.

You could try using a server side rule (via the outlook client) that "Forwards" the message to the ISP mail address. Note that I think that there may be some dangers in Exch 5.0 with this - if there is a rule or autoresponder on the other end you might cause a loop. A forward is a new message and thus making loops possible/dangerous but possibly bypassing their relay protection. I personally feel uncomfortable with forwards having experienced an outage many years ago due to a loop filling the Information store! We disallow forwards beyond our Ex2000 organisation, but in a small organisation maybe it is OK?

Cheers

[Chris Bedford]

Thanks David - It looks as if an Out of Office reply is the way to go. Problem with that is the Outlook client always prompts you to switch it off every time you start it -- and most users automatically hit "yes" without reading the message! Also I have had difficulty redirecting outside the organisation with 5.0 -- perhaps time to revisit the config.

I'd still like to sort out the redirect / alternate client thing though!

[David Borojevic]

Try Technet - PSS ID Number: 216397. Although it is for 5.5 you would probably find it is similar in 5.0??. The relevant extract is..

SYMPTOMS
When you have an Out of Office rule set to forward all messages to an external SMTP address, it does not forward the messages. If the rule is configured to forward messages to an internal e-mail address, the messages are forwarded correctly.
CAUSE
This functionality is disabled in the Internet Mail Service by default. [To reduce risk of mail loops!!! DB]
WORKAROUND
To work around this problem and allow automatic forwarding to an SMTP address, perform the following steps on the Exchange Server computer:
Click the Internet Mail tab on the Internet Mail Service.
Click the Advanced tab, and then click to clear the Disable Out of Office responses to the Internet, and Disable Automatic Replies to the Internet check boxes.NOTE: You must stop and start the Internet Mail Service for these changes to take affect.

Cheers

PS: You can do it via a rule rather than Out of office assistant can't you. You may still have to make a custom recipient in Exchange Admin though?

[Chris Bedford]

Thanks David -- I had forgotten about those settings in the IMC. And I'll investigate the rules thing...

Thanks for the trouble.

[Chris Bedford]

Long time ago... ditched 5.0