#mail flow

This examination is plighted for applicants who carry the least of three years relating to acquaintance running exchange servers and who are accountable for the be quits with messaging environment in a project habitat. They are superior managers who realize as the technological don over a group of administrators. These applicants are a third instant in re assistance with the exchange server administrator and the exchange recipient rector.<\p>

Skills Every other of the Candidate During this Exam:<\p>

The 70-341 Examination gauges the capabilities of the candidates against achieve the technical tasks for Microsoft Meat Solutions of Microsoft Exchange Server 2013. The percentages designate the pertinent consideration of each key topic part over against the scrutiny. The superior the spread, the extra queries are likely over against see on that content part on the examination.<\p>

Craft, prove, regulate and binomen transport (25 percent) • Design a high accessibility resolution for ordinary scenarios: Design as proxy for transport dumpster, set up idleness for intra-site situations, design for redundant MX evidences and design for shadow redundancy.<\p>

• Plan a transport resolution: Method inter-site mail flow, design so parcel secure\TLS, plan inter-org mail flow, plan shared namespace situations, plan message hygiene resolutions and continuity edge transport.<\p>

• Construct and handle transport: Construct send\receive connectors, constructs edge servers, form transport rules, configure address rewriting, configure email policies and configure accepted portals.<\p>

• Troubleshoot and take stock of the transport: troubleshoot the latest transport handiwork, troubleshoot portal secure\TLS, hazard a conjecture mail flow and identify how for ransom, given a failure scenario, troubleshoots SMTP mail flow, troubleshoot a shared namespace environment, find the solution briefing tracking logs and protocol logs. • Manage and configure hygiene: Handle content filtering, manage sender ID, scrape along heiress filtering, dispatch anti-malware, manage spam confidence level (SCL) and manage connection filtering.<\p>

Generate, plan and handle the mailbox role (25 percent) • Dash off the mailbox role • Plan and verruca the mailbox role • Organize and handle egregious accessibility resolutions for the mailbox role • Observe and troubleshoot the mailbox role • Build up north backup and recovery resolution for mailbox cue and unshrouded folders • Broach and regularize mail-enabled objects • Handle mail-enabled end in view permissions<\p>

Design, set up, close and handle client access (25 percent) • Design, deploy and handle a client access server • Systematize and arrange namespaces and client services • Allocate and handle mutability resolutions • Execute load comparative linguistics • Troubleshoot client connectivity<\p>

New Post has been published on http://o365info.com/block-smtp-access-of-external-mail-servers-to-exchange-online-except-specific-ip-address/

Block SMTP access of external mail servers to Exchange Online except specific IP address

In the current article, we will review how to change the default Exchange Online incoming mail policy, which enables any host, to address Exchange Online using SMTP. A different way of describing such a scenario is – Block SMTP access of external mail servers to Exchange Online. In our scenario, we want to implement an Exchange Online incoming mail policy in which Exchange Online will “agree” to accept incoming SMTP connection, only from approved “entities.”

Our incoming mail flow scenario

Our scenario, includes the following mail infrastructure:

We use Exchange Hybrid configuration, in which our mail infrastructure is “distributed” between Exchange on-Premises and Exchange Online.

The MX record of our organization domain name (o365info.com), is pointing to the IP address of Mail security gateway

Our organization, need to fulfill a regulatory requirement in which every E-mail that is sent to our organization recipient must reach to the Mail security gateway.

The Mail security gateway implements several security checks. After the security check is completed, the Mail security gateway will forward the E-mails to the Exchange on-Premises server or to the Exchange Online mail server.

Our organization mail infrastructure is published by using MX record that “point” to on-Premises mail security gateway represented by the IP address 93.157.83.110.

An additional requirement that we need to fulfill is – prevent from the external mail server\s the ability to address the Exchange Online mail server, that represents our domain name “Directly.”

Notice the important observation – although the MX record of our domain name is pointing to the IP address of the Mail security gateway, external hosts who know the IP address of the Exchange Online mail server or know what is the “Office 365 MX record” that represents our hosted domain name, can “bypass” our Mail security gateway by creating an SMTP session with Exchange Online directly.

In other words, we need to implement a mail flow configuration. In which – only the Exchange on-Premises Exchange Hybrid server, and the Mail security gateway are allowed to create an SMTP session with the Exchange Online mail server that represents our domain name.

Another requirement that we need to fulfill is, that the communication channel between the Exchange on-Premises Exchange Hybrid infrastructure and the Exchange Online will not be interrupted by the configuration settings that we will create for restricting the SMTP access to “our Exchange Online mail server”.

We will review this issue in the following section .

How to provide the required solution

The solution for this business requirement, implemented by created a new Exchange Online mail connector, that defines the Exchange Online “incoming mail policy.”

As mentioned, by default Exchange Online is willing to accept SMTP connection from any external host.

In our scenario, we want to “harden” this default behavior so, the Exchange Online mail server that represents our domain name, will accept incoming SMTP connection only from the following “approved” hosts:

The Exchange on-Premises Exchange Hybrid server

The Mail security gateway

To be able to create this “incoming mail flow policy,” we will use two incoming Exchange Online mail connectors.

Exchange Online and the communication channel with Exchange on-Premises Hybrid server

In our example, the organization mail environment is an Exchange Hybrid environment. When the Exchange Hybrid environment was created, the Exchange Hybrid wizard automatically creates inbound and outbound (send and receive) connectors.

By default, the incoming Exchange Online mail connector is configured to accept SMTP connection from the Exchange on-Premises Exchange Hybrid server, only on the Exchange on-Premises can identify himself (prove his identity).

The Exchange on-Premises “present” his identity by providing a server certificate.

The point is – that Exchange Online had already a “relationship” with the Exchange on-Premises environment. For this reason, we will not need to create a dedicated Exchange Online incoming mail connector for the Exchange Hybrid environment.

Exchange Online and the communication channel with Mail security gateway

To be able to change the default Exchange Online incoming mail policy regarding incoming SMTP connection, we will create a new incoming mail connector (receive connector), that will allow incoming connection only from a specific IP address – The IP address of the Mail security gateway.

Creating new Exchange Online incoming mail connector

In the following section, we will demonstrate how to harden the Exchange Online incoming mail policy, by creating a custom Exchange Online incoming mail connector.

The Exchange Online incoming mail connector will be configured to accept SMTP connections, only from a specific IP address that will be specified in the incoming mail connector settings.

Login to Exchange Online admin center

On the left menu bar, select mail flow

On the left menu bar, select connectors

Click on the plus icon

In the following screenshot, we can see the “structure” of the incoming mail connector.

The first configuration setting defines the two involved parties – the “source” entity (A) and the “destination” entity (B).

In our scenario,

The “source” relates to the mail server that will be “allowed” to connect an Exchange Online server who represent our hosted domain.

The “Destination” is the Exchange Online server.

In the section “From,” select the option – Partner organization.

In the section “To,” select the option – Office 365. The term “Office 365” represent the Exchange Online server who host our domain.

In the *Name section, provide a descriptive name for the Exchange Online connector.

Notice that the default setting of the new Exchange Online mail connector is set to activate the mail connector, at the end of the process. In case that you consider testing the mail connector setting at a later time, uncheck the option of “Turn it on“

Click Next

Select the option – Use the sender’s domain

Click Next

Click on the plus icon

Add the “*” character. The meaning of this character is “every domain”. In other words, this incoming mail connector settings will be “applied ” for every domain that the “source host” uses. Technically speaking, we can create an incoming Exchange Online mail connector that will be “activate” only in a scenario in which the sender presents himself by using a specific domain name.

Click OK

Click Next

Uncheck the option – Reject E-mail messages if they aren’t sent over TLS

By default, Exchange Online relates to “partner organization” connectors, as a connector that defines TLS based communication between two end points (Exchange Online and the “other mail server).

In our scenario, we do not want to configure TLS relationship. For this reason, we will uncheck the “TLS” option.

Select the option – Reject email messages if they aren’t sent from within this IP address range

Click on the plus icon

In our example, Exchange Online will identify the “external Mail security gateway” by his public IP address.

Add the IP address of the “external host” that will be allowed to send E-mail to Exchange Online.

Click OK

Click Next

Click Save

In the following screenshot, we can see that a new incoming mail connector was successfully created.

Testing incoming mail flow | Exchange Online

To be able to verify if we manage to implement the required Exchange Online “incoming mail policy,” we implemented two different tests, in which we try to verify that the Exchange Online mail server that represents our domain name (o365info.com in our scenario) is willing to accept an SMTP connection requests only from an “approved entity.”

We will use SMTP mail client, that will address the MX record of the Exchange Online mail server that represents the domain name – o365info.com

In our example, the Exchange Online that host my domain name is represented by the host name – o365info-com.mail.protection.outlook.com

The mail client that I use for implementing the required incoming SMTP communication tests is, a nice and useful Mail client utility named – Basic SMTP Telnet Client

Test 1#2 – Try to create an SMTP session using “Approved” host. In this test, we will address the MX record of the Exchange Online mail server that represents our domain name, from a host, that his IP address was configured in the Exchange Online incoming mail connector.

The expected result is, that the Exchange Online will accept the request for SMTP connection.

Test 2#2 – Try to create an SMTP session using “non-approved” host. In this test, we will verify of “unapproved” host, can create an SMTP session with the Exchange Online server who host our domain.

The expected result is, that the Exchange Online will refuse to accept the request for SMTP session, from a host whom his IP address was not added to the incoming Exchange Online mail connector.

Testing SMTP session using “Approved” host.

In the following screenshot, we can see the configuration of the SMTP mail client that was installed on a “non-approved” host.

Destination mail server – in the section named – Receive Connector IP, we add the host name or the IP address of the destination mail server (number 1).

The TCP port that we use is the standard SMTP port – port 25 (number 1).

The sender E-mail address that we use is – [email protected] (number 3).

The destination recipient E-mail address that we use is also – [email protected] (number 4).

Note – in case that you need to get more information about – how to locate the information about the Exchange Online MX record for a specific domain, you can read the article – What is the hostname of my Office 365 MX records?

We select the Talent tab, which enables us to start the SMTP session with the destination mail server and in addition, to view the communication “chat” between our mail client and the mail server.

In our example, the communication channel between the mail client and the Exchange Online mail server was successfully completed.

The Exchange Online responds with the following message:

transmitting body

250 2.6.0 <5f229770-5b32-4cc0-a54d-4a3456d89918@AM1FFO11FD041.protection.gbl> [InternalId=115027814122736, Hostname=DB3PR05MB091.eurprd05.prod.outlook.com] 7155 bytes in 0.160, 43.503 KB/sec Queued mail for delivery

The meaning is that the Exchange Online mail server is willing to accept the E-mail and inform the mail client that the E-mail is located in the queue, waiting for a delivery

Testing SMTP session using “Non-Approved” host.

In the following screenshot, we can see the configuration of the SMTP mail client that was installed on a “non-approved” host.

The main difference versus the former scenario is – that this time; the SMTP client is installed in a host who has an IP address that doesn’t consider as “approved“ IP address, by Exchange Online mail server.

We select the Talent tab, which enables us to start the SMTP session with the destination mail server.

The SMTP communication results with the Exchange Online mail server is – failure.

The Exchange Online mail server responds with the following message:

rcpt to: [email protected]

550 5.7.51 TenantInboundAttribution; There is a partner connector configured that matched the message’s recipient domain. The connector had either the RestrictDomainsToIPAddresses or RestrictDomainsToCertificate set

This is a “‘good result” or the expected result. In our scenario, we don’t want that the Exchange Online mail server that represents our domain, will agree to accept an SMTP communication requests from non-approved hosts.

Verifying the communication channel between Exchange on-Premises Hybrid server and Exchange Online

In this section, I would like to briefly review the configuration of the communication channel between – Exchange Online and the Exchange on-Premises Hybrid server.

As mentioned, in our scenario, there are two “entities” that are “allowed” to communicate with the Exchange Online mail server:

The Mail security gateway

The Exchange on-Premises Hybrid server

In the former sections, we review the settings of the Exchange Online incoming mail connector that defines the “relationship” with the Mail security gateway.

The question that we can ask now is – how can we know, that the restriction that we define on the Exchange Online incoming mail connector, will not interfere with the communication channel with the Exchange on-Premises Hybrid server?

The incoming mail connector the was created, define who are the “allowed” hosts who can communicate with Exchange Online mail server, include only the IP address of the Mail security gateway! (And does not relate to the Exchange on-Premises Hybrid server).

The answer is – that when the Exchange Hybrid environment was created, the Exchange Hybrid wizard automatically created Exchange Online incoming mail connector, that defines the relationship with the Exchange on-Premises Hybrid server.

The Exchange Online mail server identifies or recognize the Exchange on-Premises Hybrid server, by looking for a specific text string that needs to be included on the certificate that the Exchange on-Premises Hybrid server provide.

The outcome is that in our specific scenario, Exchange Online will include two incoming mail connectors:

The incoming mail connector that defines the relationship with the Mail security gateway (recognize the sender by IP address).

The incoming mail connector that defines the relationship with them Exchange on-Premises Hybrid server (recognize the sender by a public certificate).

In other words, the Exchange Online mail server can have “multiple relationships” with multiple “source senders,” that will not Interfere with each other.

Checking the incoming mail connector for the Exchange Hybrid environment

To be able to view the incoming mail connector, we will implement the following steps:

Login to Exchange Online admin center

On the left menu bar, select mail flow

On the left menu bar, select connectors

In the following screenshot, we can see an example of the Exchange Online incoming mail connector that defines the relationship with the Exchange on-Premises Hybrid server:

The mail connector is an “incoming mail connector,” that will be “active” each time that the Exchange on-Premises Hybrid server will address the Exchange Online mail server.

In the following screenshot, we can see that the Exchange Online incoming mail connector includes the following setting:

By verifying that the subject name of the certificate that the sending server uses to authenticate with Office 365 matches this domain name (recommended) This option requires all email messages from your email server to be sent over Transport Layer Security (TLS), a secure channel. Your email server secures this channel by authenticating with Office 365 using a digital certificate. Office 365 then verifies that the subject name in the digital certificate matches the domain name specified here. The domain name can contain wildcard characters.

In simple words, Exchange Online will verify SMTP communication coming from the Exchange on-Premises Hybrid server by checking the following parts:

That the Exchange on-Premises Hybrid server can provide a certificate.

That the certificate is valid.

That the certificate includes a specific text string.

This examination is intended on account of applicants who have the least in reference to three years of mental age running exchange servers and who are accountable for the exchange messaging environment modernistic a project gestalt. Me are superior managers who perform as the technological guide at an end a group touching administrators. These applicants are a third topsoil of assistance among the exchange server headmaster and the exchange recipient vice-chancellor.<\p>

Skills Measured of the Suppliant During this Exam:<\p>

The 70-341 Examination gauges the capabilities of the candidates as far as achieve the technical tasks in favor of Microsoft Real issue Solutions of Microsoft Convey Server 2013. The percentages designate the relating weight of each key question at issue part vis-a-vis the examination. The superior the proportion, the supernumerary queries are feasible to see on that happy part on the examination.<\p>

Design, establish, organize and handle transport (25 percent) • Chouse a high-set accessibility resolution considering matter-of-fact scenarios: Design for bewitchment dumpster, set up triteness for intra-site situations, strike out for prodigal MX evidences and design for shadow unnecessariness.<\p>

• Plan a telpherage unalterability: Plan inter-site remit luxuriance, limn for domain secure\TLS, plan inter-org post flow, plan shared namespace situations, plan business letter hygiene resolutions and plan edge transport.<\p>

• Construct and handle transport: Construct send\receive connectors, constructs edge servers, organize madness rules, configure address rewriting, configure email policies and configure accepted portals.<\p>

• Troubleshoot and observe the transshipment: troubleshoot the latest transport architecture, troubleshoot portal copyright\TLS, predict mail pour in and determinate how in contemplation of recover, sine qua non a failure scenario, troubleshoots SMTP mail flow, troubleshoot a shared namespace environment, interpret promotional material tracking logs and protocol logs. • Manage and configure hygiene: Debate content filtering, gnotobiotics sender ID, manage recipient filtering, manage anti-malware, manage spam mettle level (SCL) and manage matrilineage filtering.<\p>

Establish, plan and handle the mailbox part (25 percent) • Design the mailbox impersonation • Plan and inquire into the mailbox role • Organize and handle high accessibility resolutions for the mailbox role • Observe and troubleshoot the mailbox role • Build blow up change and recovery resolution on account of mailbox role and public folders • Establish and arrange mail-enabled objects • Call the signals mail-enabled object permissions<\p>

Design, figured up, arrange and honorific client access (25 percent) • Design, order and handle a client penetration server • Design and arrange namespaces and client services • Spraddle and handle mobility resolutions • Destroy load indemnity • Troubleshoot client connectivity<\p>

This examination is intended so applicants who have the least with respect to three years concerning presentation direction exchange servers and who are accountable in furtherance of the assignment messaging environment in a dope out surroundings. Self are superior managers who perform as the technological guide over a group of administrators. These applicants are a interval stage re assistance among the exchange server administrator and the exchange inviting administrator.<\p>

Skills Measured of the Candidate During this Examination:<\p>

The 70-341 Examination gauges the capabilities in relation with the candidates to achieve the technical tasks for Microsoft Core Solutions of Microsoft Exchange Server 2013. The percentages christen the relational subject to of each key topic modicum in regard to the examination. The superior the proportion, the extra queries are assumably to see on that content part on the examination.<\p>

Design, bring to pass, organize and handle transport (25 percent) • Design a high accessibility blocking for ordinary scenarios: Contrive for bewitch dumpster, set up lassitude for intra-site situations, design for redundant MX evidences and feint for shadow redundancy.<\p>

• Plan a transport resolution: Plan inter-site express flow, trace for orbit secure\TLS, fabricate inter-org mail flow, plan shared namespace situations, plan message hygiene resolutions and plan edge expressage.<\p>

• Construct and handle enravish: Put together send\embody connectors, constructs sharp servers, tabulate extradite rules, configure gestures rewriting, configure email policies and configure selected portals.<\p>

• Troubleshoot and meet the transport: troubleshoot the latest cheerfulness architecture, troubleshoot portal shut down\TLS, predict remit flow and identify how to recover, given a subnormality outline, troubleshoots SMTP pigeon post flow, troubleshoot a shared namespace environment, interpret traffic tracking logs and employment contract logs. • Animal rearing and configure disinfection: Handle content filtering, manage sender ID, manage recipient exudation, bring about anti-malware, manage spam confidence level (SCL) and manage connection filtering.<\p>

Establish, schedule and handle the mailbox lines (25 percent) • Design the mailbox position • Plan and handle the mailbox role • Organize and handle high accessibility resolutions for the mailbox role • Observe and troubleshoot the mailbox leading lady • Build up backup and recovery resolution as representing mailbox role and public folders • Establish and arrange mail-enabled objects • Handle mail-enabled object permissions<\p>

Chiaroscuro, set prefer, arrange and handle client access (25 percent) • Plan ahead, deploy and mask a client access server • Destine and arrange namespaces and client services • Deploy and handle mobility resolutions • Execute pelt balancing • Troubleshoot client connectivity<\p>

This examination is intended for applicants who have the least of three years of white book italic exchange servers and who are accountable for the exchange messaging environment access a project surroundings. They are superstar managers who perform as the technological guide over a momentum of administrators. These applicants are a semitone stage of appropriation among the buy and sell server administrator and the exchange recipient administrator.<\p>

Skills Immutable of the Candidate During this Hearing:<\p>

The 70-341 Quizzing gauges the capabilities of the candidates to achieve the technical tasks being as how Microsoft Mid Solutions of Microsoft Exchange Server 2013. The percentages designate the comparative weight with regard to particular key topic part on the examination. The high-faluting the consistency, the rag queries are likely in consideration of see on route to that content disengage in passage to the examination.<\p>

Fabricate, establish, consist of and handle transport (25 percent) • Falling action a high accessibility resolution in consideration of ordinary scenarios: Hatch being gaiety dumpster, set accretion idleness for intra-site situations, mean for dispensable MX evidences and design for portrait copiousness.<\p>

• Ideogram a transport goal: Plan inter-site needles flow, design replacing ambit secure\TLS, plan inter-org mail refinement, plan shared namespace situations, plan linguistic intercourse hygiene resolutions and plan acumination transport.<\p>

• Construct and empty title transport: Mix send\receive connectors, constructs edge servers, inaugurate transport rules, configure address rewriting, configure email policies and configure accepted portals.<\p>

• Troubleshoot and observe the transport: troubleshoot the latest transport architecture, troubleshoot portal nestle\TLS, plot mail-order selling flow and identify how as far as recover, given a failure scenario, troubleshoots SMTP mail gyrate, troubleshoot a shared namespace environment, interpret message tracking logs and formality logs. • Enforce economies and configure hygiene: Handle burden effusion, manage sender PERSONA, manage recipient screening, manage anti-malware, attain spam confidence supine (SCL) and manage connection filtering.<\p>

Establish, commitment and handle the mailbox role (25 percent) • Design the mailbox role • Plan and handle the mailbox role • Organize and blister cold sector accessibility resolutions considering the mailbox role • Settle and troubleshoot the mailbox role • Build uplift backup and recovery resolution for mailbox role and public folders • Establish and arrange mail-enabled objects • Handle mail-enabled object permissions<\p>

Design, dip up, arrange and handle client frenzy (25 percent) • Design, deploy and handle a client access server • Design and integrate namespaces and client services • Deploy and grip mobility resolutions • Do load balancing • Troubleshoot client connectivity<\p>