Exchange Server 2010 SMTP Connectors

Previous versions of Exchange Server supported SMTP, but they relied on a service provided by the underlying Windows operating system. Exchange Server 2010, on the other hand, has its own built-in SMTP server. As a matter of fact, the installation of Exchange Server 2010 requires that you do not have the SMTP service already installed on your underlying Windows platform.

In Exchange Server, for SMTP traffic to travel between computers, SMTP connectors are used. SMTP connectors are logical representations of connections between a source and destination server. These connectors dictate how Edge Transport servers and Hub Transport servers communicate with each other, with the Internet, and with previous versions of Exchange Server.

There are two types of SMTP connector in Exchange Server 2010, Send Connectors and Receive Connectors. Each of these types of connector represents a one-way connection, and the configuration of the connector mandates how messages will be transported.

To secure your Microsoft Exchange Server 2010 environment, you must have an understanding of these connectors and how to configure them properly.

Connector Topology

For messages to flow between servers in an Exchange Server organization, or between the organization and the Internet, several SMTP connectors must be in place and properly configured. These connectors are the minimum that are required for proper end-to-end mail flow. Table 1 lists these connectors.

Understanding Receive Connectors

SMTP Receive Connectors serve the purpose of acting as incoming connection points for SMTP traffic and dictate how incoming SMTP communications are managed on an Exchange Server 2010 transport server. The Receive Connector actively listens for incoming connections that match all settings configured on the connector, such as connections utilizing a particular port or from a particular IP address range.

Receive Connectors have many configurable limits that can be set, such as the following:

• Number of active connections allowed

• Maximum incoming message size

• Maximum recipients per message

Receive Connectors are configured on a single server and determine what particular message traffic that server will listen for. If the Receive Connector is created on a Hub Transport server, it is stored in Active Directory as a child object of that server. However, when it is created on an Edge Transport server, the connector is stored in Active Directory Lightweight Directory Services (AD LDS), previously known as ADAM.

Understanding Send Connectors

SMTP Send Connectors are used for relaying outgoing SMTP communications. Unlike Receive Connectors, Send Connectors are not scoped to a single server. When an Exchange Server 2010 server receives an SMTP message that is addressed to a remote destination, the message is relayed to an appropriate Send Connector that is configured to handle messages intended for that destination.

In Active Directory or in AD LDS, a Send Connector is created as an object in a connectors container. A connector can have more than one source server, which is defined as a Hub Transport server that is associated with that connector.

For example, if a Send Connector is configured to handle message routing to a domain that is external to the organization, whenever a Hub Transport server receives a message destined for that remote domain, the message is routed to the Send Connector to be relayed appropriately.

As with Receive Connectors, a variety of configuration settings can be defined by the administrator. Send Connectors can be created and viewed in either the Exchange Management Console or the Exchange Management Shell, but the majority of the configuration must be accomplished using the Exchange Management Shell. Send Connectors are stored in Active Directory as a configuration object, and can be viewed from the Exchange Management Console by going to the console tree, selecting Organization Configuration, and then selecting Hub Transport. Next, in the results pane, select the Send Connectors tab.

How Connectors Are Created

As previously mentioned, connectors must exist between all messaging servers for SMTP traffic to be passed. However, inside the Active Directory forest, you do not have to create and configure the connectors between Hub Transport servers. These connections are created implicitly. This means that the connections are created by computing a path between AD sites that is based on Active Directory site link costs.

After you install an Edge Transport server and a Hub Transport server, the Edge Transport server must be subscribed to an Active Directory site by using the Edge Transport subscription process. This process enables the EdgeSync service to establish one-way replication of recipients and configuration details from the AD directory service to the AD LDS instance. This subscription process can be accomplished quickly and easily by following the steps listed on the Finalize Deployment tab on the Exchange Management Console. To get to the Finalize Deployment tab, open the Exchange Management Console and click on Microsoft Exchange in the console tree.

When you subscribe the Edge Transport server, data that is stored in Active Directory gets replicated to the AD LDS instance located on the Edge Transport server. Some examples of the data that gets replicated are as follows:

• Configuration of Send and Receive Connectors

• Domains to accept SMTP traffic from

• Remote domains

Connectors can be created using one of the following methods:

• Explicit Active Directory Connector— When an administrator creates a connector in the Exchange Server organization, an explicit connector is created. This object can be modified by the administrator and changes are replicated throughout the organization.

• Explicit AD LDS Connector— When an administrator creates a connector on an Edge Transport server, it is stored in AD LDS. Connectors that are created on Edge Transport servers are scoped to a single server. An administrator can modify this object; however, the configuration applies only to that particular connector on that Edge Transport server only.

• Implicit— Implicit connectors are automatically computed using Active Directory site link information and existing explicit Active Directory connectors. This connector cannot be modified, and cannot be viewed either in Active Directory or AD LDS. The only way to change an implicit connector is to make a change to the system topology. When a change to the topology is made, the connector is recomputed.

• Automatic Explicit AD LDS Connector— When you subscribe an Edge Transport server, the EdgeSync subscription process creates an Automatic Explicit AD LDS connector inside the Exchange Server organization. This connector is then replicated to the AD LDS instance on the Edge Transport server. This connector cannot be modified on the Edge Transport server, but can be modified in Active Directory. Any changes made in Active Directory are replicated to the Edge Transport server during routine synchronization.

• Automatic Implicit AD LDS Connector— All implicit connectors are computed from the system topology as described previously. This applies to Automatic Implicit AD LDS connectors as well. One or more Edge Transport servers must have access to the information contained in this connector. This connector cannot be modified in Active Directory; however, if a change is made to the system topology, the connector changes resulting from the topology change will be replicated to the Edge Transport server during routine synchronization.

Hub Transport Server Connectors

After the Hub Transport server role has been installed on an Exchange Server 2010 server in your environment, you must configure the appropriate Send and Receive Connectors. Until this has been accomplished, the server will be unable to send SMTP messages to, or receive them from, the Internet.

Send Connectors are configured in the Exchange Management Console in the Organization Configuration node, and are stored in AD as a configuration object. The Send Connectors must be configured so that the Hub Transport server knows what source server to forward the message to. Bear in mind, there can be multiple source servers configured on the connector.

Receive Connectors, on the other hand, are configured in the Exchange Management Console in the Server Configuration node, and are stored in AD as a child object of the server. By default, when a Hub Transport server is brought online, it has two default Receive Connectors already configured.

Both Send and Receive Connectors can be viewed and modified using the Exchange Management Shell. As a matter of fact, many configuration settings can only be accomplished using the Exchange Management Shell.

So, SMTP Send Connectors handle outgoing messages; SMTP Receive Connectors handle incoming messages. For proper message flow, the Hub Transport server must have the appropriate connectors to allow mail flow to and from the Internet (by relaying through an Edge Transport server), as well as to and from other Hub Transport servers.

A Hub Transport server must have at least three required connectors to function properly. The first two, both of which are Receive Connectors, are created automatically during the installation of the Hub Transport server:

• A Receive Connector that is configured to accept SMTP messages on port 25 from all remote IP addresses. The usage type for this connector should be “Internal” as well. This connector is automatically generated during the installation of the Hub Transport server.

• A second Receive Connector that is configured to accept messages on port 587 from all remote IP addresses. This connector is needed to accept SMTP connections from non-MAPI clients who are connecting through a client access server. The usage type for this connector should be set to “Internal.” This connector is automatically created during the installation of the Hub Transport server.

The third required connector is a Send Connector:

• By default, no explicit Send Connector exists on the Hub Transport server, so you must perform one of two actions to create it—either the connector is automatically generated when you create an Edge subscription, or you must manually configure it. After this process has been completed, your environment will be ready to route Internet-bound messages from the Hub Transport server to the Edge Transport server, and then out to the Internet.

Automatic Creation of Send Connectors

To automatically create the Send Connector, you must have a server with the Edge Transport server role and utilize an Edge subscription and the EdgeSync service. To do so, perform the following steps:

new-edgesubscription – filename "c:\server1info.xml"

Data replicated to AD LDS includes the Internet Send Connector. This connector is stored in AD and the settings for it are written on the Edge Transport server in the local AD LDS instance. The connector has the Edge Transport server as the source server, and is configured to use DNS MX records to automatically route messages.

Manual Creation of Send Connectors

If you decide not to use an Edge subscription, you must manually create and configure the Send Connector. To do so, follow these steps:

1.	Start the Exchange Management Console.
2.	In the console tree, expand the Organization Configuration node, and then select the Hub Transport node.
3.	In the action pane, click New Send Connector. The New SMTP Send Connector Wizard starts.
4.	On the Introduction page, type a name for the connector, and then select the intended usage from a drop-down box—the intended usage should be set to Internal for this scenario because it will be sent to the Edge Transport servers. Click Next to continue.
5.	On the Address Space page, click Add, and enter * (all domains) as the address space. Leave the Include All Subdomains check box checked, and click OK, as shown in Figure 1. Click Next to continue. Figure 1. Configuring a Send Connector.
6.	On the Network Settings page, ensure the Route All Mail Through the Following Smart Hosts option button is selected, and then click Add.
7.	Enter the IP address or FQDN for the Edge Transport server, click OK, and then click Next to continue.
8.	On the Smart Host Security Settings page, select the Exchange Server Authentication option button, and then click Next to continue.
9.	Select one or more Hub Transport servers as the source for the connector, and then click Next.
10.	Review the Configuration Summary, and then click New to create the connector.
11.	From the Completion page, click Finish.
12.	Now, you must perform manual configuration of the required connectors on the Edge Transport server. This information is covered in the next section.