Front-end/back-end exchange servers relay and junk emails issues ......................... !!

Hi,

You need to make sure that only the FE is connected to the internet or at least no one can connect to your BE from the outside world at all, only on the FE on port 25.

Then you need to check on ONLY THE LIST BELOW, leave the list empty and then check on allow users who can successfully authenticate to relay. this settings should be on both servers.

And then try to telnet on the FE and the BE and check where is the problem, only make sure to telnet without a firewall in between.

once you closed the relay it doesn't mean that the queues will be empty you need to follow: http://support.microsoft.com/kb/324958.

I hope that helps.

If you need to have "only the list below" NOT selected, then you have a problem elsewhere with the configuration of the server or the Exchange org.
You already have the link to my guide on how to ensure that your server is not an open relay, but to confirm, Only the list below should be blank and anonymous enabled. Anything else and something isn't correct.
One example could be an external email domain not listed in recipient policy correctly.

Simon.

Thanks you very much, guys, I really appreciate all your comments.

In SMTP virtual server Relay setting, I had "Only the list below" selected and kept the list blank. that turned off the relay from front-end Exchange. Also I had the annonymous access on in authentication setting too. The problem is I can connect to the FE server port 25 but can't relay the email to the back-end server. I have to choose "all except the list below" in Relay setting and then the incoming emails went to the BE mailbox, but that opens up my FE relay again. Is there any way I can specify on FE server to just relay emails to my email domain to the BE server but not relay any other emails ? I got to have somewhere setting wrong for this but just can't figure it out. Thanks again for any help.

John

Hi John.

Please check that your correct internal and external domain(s) are exsists in the RUS (recipient Update Service) - if you need detailed steps let me know.

also add (for testing) the IP of the FE on the BE relay and the IP of the BE on the FE - to see.

a good idea would be to telnet from an external computer to your server and past the result here.

Cheers

MG

Thanks a lot, MG,

Please provide the detail steps for checking the RUS.
When I tried to telnet test from outside the network, I got the following message :

RCPT TO:< test@mydomain.com>
550 5.7.1 Unable to relay for testuser@mydomain.com
[Address has been rejected]

This is with "Only the list below" on both FE and BE servers and both lists had BE and FE IPs in the list.
But in Relay setting, if I check "all except the list below", that will pass the inbound emails to the BE server. Is there any way I can restrict the relay to  "Only the list below" and only pass the emails to my email domain to BE ?

John  

Thanks, Simon,

I agree with your comment, maybe it's not a relay issue, exchange server should handle the mail delivery once the FE server receives the email to the BE server mailbox, but how ? I only have to specify the the one exchange srv to be the Front-end server and that's it. How does this FE know where and which other exchange srv is the Back-end srv ? The only time I get email delivered to the back-end mailbox is in FE srv relay setting / choose all except the list below, but that opens up the FE relay to internet. If exchange FE is not using relay to delivery the emails, whereelse I have to check the settings ? Thanks a lot for the help !!!!!

John

Oh, by the way, my FE and BE servers are all behind the firewall on the same subnet, nothing sits in between of those two servers now. Thanks.

Thanks a lot, everyone out there for help,

I got it working now, I have to change the email address policy to match my email domain address instead of using default AD domain name, turn off the SMTP relay, eveything works fine now. Thank you very much for the help again, really appreciate it.

John