<

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x

Exchange DNS Configuration

Published on
68,952 Points
22,152 Views
48 Endorsements
Last Modified:
Awarded
Community Pick
I have seen a number of questions over the past few months regarding DNS configuration for an Exchange Server. Incorrectly configured DNS can cause your server to be rejected by receiving servers that are performing certain types of checks on the mail it receives.

One of the most common of these is the rDNS lookup which basically checks that the server sending the message actually exists.

I will try to cover the correct configuration here for hosting your own mail server and sending mail out via DNS rather than a smart host. This configuration is not as important if you send via a 3rd party relay.

MX Configuration
The MX record(s) for your domain provide systems sending you e-mail with the correct path for your mail server. If you're using a relay/SPAM service then your MX record will be configured to use their servers' host names. If you host your own server, the MX record will be configured with your server's IP address.

Step 1
Confirm the External IP address your server is using. This can be achieved by simply going to http://whatsmyip.org from your Exchange Server. At the very top of the screen this will provide you with your IP address.

Step 2
Create an A record in the DNS that controls your EXTERNAL domain name. This is the DNS for the part after the @ in your e-mail address. I always use mail.domainname.com but you don’t have to. It doesn’t matter what you use as long as it’s consistent.

Step 3
You now need to configure the MX record for your main domain -- the one after the @ sign for which you want to receive email. To do this, edit the DNS settings for that domain and set the MX record to use the A record you have configured in Step 2.

Do not use IP addresses or CNAME records for the MX entry as this can throw up errors on DNS lookups and is also against RFC standards. See RFC2181: http://tools.ietf.org/html/rfc2181#section-10.3, section 10.3

Extract: "This domain name must have as its value one or more address records. Currently those will be A records, however in the future other record types giving addressing information may be acceptable.  It can also have other RRs, but never a CNAME RR."

If you only have a single connection to the internet then only setup 1 MX record, and avoid giving it a value of 0 - use 5 or 10. This will be your PRIMARY MX.

If you have a second connection to the internet that has a different IP address that you use for backup purposes in case your main line goes down then add a secondary MX with an A record that is configured for this IP address with a higher value, of say 20.

If you only have a single server, avoid the temptation to setup multiple MX records either setting up two MX records pointing to the same IP address as this is a complete waste of time, or one pointing to your own server and one pointing to a backup MX server hosted for you as this will get targeted by spammers and you will be forwarding spam from your secondary MX to your Exchange server.

Step 4
Contact your ISP as you will need to configure a Reverse DNS, also referred to as a PTR (pointer) record. This is against your IP address so can only be done by the company that provide your internet connection. Whilst a generic rDNS record will work, any systems doing strict lookup will fail your server if it doesn’t match the A record configured in Step 2 so, therefore, it is best practice to configure your rDNS to use mail.domainname.com (A record configured in Step 2)

Step 5
Modify your send connector/SMTP Connector. Depending on which version of Exchange Server you are using this process will be different.

In Exchange 2007 & 2010 the Send Connector will need to be modified.

Open Exchange Management Console, navigate to Organisation Configuration > Hub Transport > Send Connector and right click on the send connector configured for internet usage and select properties.

 send_connector
On the first screen you will see a FQDN box. This should match the A record you created in Step 2. For consistency you may also want to do the same on the Internet Receive Connector which is located under Server Configuration > Hub Transport and by default it will be the one that starts with Default.

In Exchange 2003 you will need to modify the properties of the SMTP Virtual Server.

Open Exchange System Manager, navigate to Administrative Groups > First Administrative Group > Servers > Servername > Protocols > SMTP and right click on the Default SMTP Virtual Server select properties.

 smtp_virtual_s
Under the delivery tab click Advanced and enter the A record you created in Step 2 for the Fully Qualified Domain Name

Summary

In summary then your DNS configuration should look like this:

•A record mail.domainname.com configured for IP address of your server
•MX record for domainname.com configured to use A record mail.domainname.com
•rDNS configured to use mail.domainname.com
•Send Connector/Receive Connector in Exchange 2007 FQDN set to: mail.domainname.com
•SMTP Virtual Server in Exchange 2003 FQDN set to: mail.domainname.com
48
Author:Glen Knight
  • 5
  • 3
  • 2
  • +8
18 Comments
LVL 23

Expert Comment

by:Malli Boppe
Couldn't understand the below

"If you only have a single server, avoid the temptation to setup multiple MX records either setting up two MX records pointing to the same IP address as this is a complete waste of time, or one pointing to your own server and one pointing to a backup MX server hosted for you as this will get targeted by spammers and you will be forwarding spam from your secondary MX to your Exchange server"
0
LVL 74

Author Comment

by:Glen Knight
Hi mboppe.

I struggled a bit with the wording of this section, basically some Exchange admins configure 2 MX records for the same server but just with different values (say 10 & 20) I can only assume because most DNS reports will give an error if only one MX record exists.

Others will setup a catchall mailboxes at their ISP and point their second MX record to this.

The problem with this is that:

a) It will cause regular mail to be sent to your secondary MX record if your primary is temporary unavailable or under load
b) Because of it's lower value it will be targetted by spammers because it is considered to be less protected because it is a BACKUP MX.

Is that a little clearer? if not let me know specifically what it is your not happy with and I can try and help

Thanks
Glen
0
LVL 23

Expert Comment

by:Malli Boppe
Demazter

So you are saying that unless a organisation has 2 public IPs pointing to 2 different servers  no point in configuring 2nd mx record.Is this right.

And also not a good practice to configure 2nd mx record to ISP?If thats the case then say you primary record goes down and you can't bring it back within 48 hrs then you would lose the email isn't it.

"Because of it's lower value it will be targetted by spammers because it is considered to be less protected because it is a BACKUP MX." should be Because of it's higher value isn't it.
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

LVL 74

Author Comment

by:Glen Knight
Lower priority rather than value.

"And also not a good practice to configure 2nd mx record to ISP" absolutely, becuase this will result in mail being sent to your ISP if you primary MX is temporarily unavailable or under load.
0
LVL 74

Author Comment

by:Glen Knight
Have a read of: http://blog.sembee.co.uk/archive/2007/02/02/38.aspx from Mestha EE's top Exchange Expert and Microsoft Most Valued Profesional for Exchange
0
LVL 23

Expert Comment

by:Malli Boppe
Thanks Demazter
Great Article
0

Expert Comment

by:flf4eva
Thank you
0
LVL 6

Expert Comment

by:YohanF
Nice one!
0
LVL 3

Expert Comment

by:cshell_1987
Good job!
0

Expert Comment

by:acampos
demazter, once again thank you for your excellent articles.

I have one question. I have multiple domains being managed by my Exchange 2010. Basically each user in AD is linked to a set of email addresses. for example

AD user: De Mazter is assigned De.Mazter@mydomain1.com, @mydomain2.com, etc etc. but all of them pointing to one mailbox.

i had my IPS to create a RDNS pointing to domain1.com which is my main domain (the one with a certificate also for web access). https:/mail.mydomain1.com/OWA

my question is... why after all these steps, i am still getting Warning - Reverse DNS does not match SMTP Banner when i go to mxtoolbox.com.

Also, i am getting a lot of rejected emails from comcast, att, cox... like if we were in black list or our RDNS wouldnt be configured correctly. RDNS it's correct as far as i know.

Thank you
0
LVL 74

Author Comment

by:Glen Knight
Check the SMTP banner on your Receive connector you will probably find it doesn't match your rdns?

The multiple domain issue is irrelevant.

Basically you have it setup as follows:

A record = mail.domain1.com
MX record for domain1.com = mail.domain1.com
RDNS = mail.domain1.com

And if you really want to be sure send and receive connectors should also be mail.domain1.com.  Send connector is the important one the receive connector not so important (this is the one you are getting an error for)

Then MX record for domain2.com = mail.domain1.com and MX record for domain3.com = mail.domain1.com so basically all mx records use the A record that your rDNS is configured to match.

Does that make sense?
0
LVL 10

Expert Comment

by:JaredJ1
0
LVL 74

Author Comment

by:Glen Knight
I didn't forget to mention them I deliberately left them out. :)

SPF records are still not widely used and a missing SPF record is actually better than a misconfigured one which is why I didn't refer to them.
0

Expert Comment

by:Claimtrust
Great article, very helpful.

I also have a question, I have 2 different domains (abc.com and xyz.net), in 2 different forests , both are running Exchange 2007. I want to setup users in domain abc.com to have an email address xyz.net was well as abc.com email address. Do I just setup a PTR for xyz.net to point to the ip address of abc.com?
 If so, does that cause any email routing issues externally? If that is not the best way to do it, any other suggestions how?
0
LVL 1

Expert Comment

by:jaramart
Howdy i was wondering if someone could help? I am trying to set up my exchange server i am running SBS 2008 with exchange 2007 all in the one box. When i run the configure internet address wizard it does not let me choose .org.au as an option. thus i choose to configure it myself.

at the moment i have three DNS "zones"
1. Forward look up zone
2. Reverse lookup zone
3. Conditional Fowarders.

Am i supposed to have an external Zone? if so where do i create this? how am i supposed to do this?

Basically what is happening when a user logs on the there computer and runs outlook 2007 it starts the email config wizard and searches for the email settings and comes back with my local domain name longridgerv.local but it should come back with longridge.org.au when i manualy enter this and users name and password and click connect it instantly pops up with welcome back to remote.longridge.org.au and asks for a user name and password when i enter it there it just keeps poping up til it finally says cannot connect. What am i missing?

One other thing i had one user out of 50 connect straight away no problems but now it just keeps asking for password
0

Expert Comment

by:Hieristie
Good article!

I still have a question. Do I still have to change my FQDN on my internal mail server when using a UTM which sends and receives the mail on the outside, say smart host? I configured that with the name of the MX and A record where my domain is hosted? My PRT, A an MX records are pointing to my internal mail server on my local domain and the MX and A record (unable to add a PRT) with my domain hosting partner are pointing to my static ip, which will be forwarded to the UTM.
0

Expert Comment

by:SELVA YOGESH
Dear Sir,
I am a beginner in exchange, for my study purpose i installed one domain controller and another one server with exchange server on Vmware workstation.
Now my requirement is send mail to outside world.  And I have not configured any relays etc. I got a free domain and hosted it freely. For that on where I should configure my DNS records, either on server or on hosted server.
0

Expert Comment

by:SELVA YOGESH
Dear Sir,
I am a beginner in exchange, for my study purpose i installed one domain controller and another one server with exchange server on Vmware workstation.
Now my requirement is to send mail to outside world.  And I have not configured any relays etc. I got a free domain and hosted it freely. For that on where I should configure my DNS records, either on server or on hosted server. Is it must to create SMTP relay.
Kindly guide me how to proceed further.
0

Featured Post

Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

how to add IIS SMTP to handle application/Scanner relays into office 365.
This video discusses moving either the default database or any database to a new volume.

Keep in touch with Experts Exchange

Tech news and trends delivered to your inbox every month