Link to home
Start Free TrialLog in
Avatar of msghydron
msghydron

asked on

SMTP call-ahead for recipient validation

We have two Cisco IronPort C360 appliances doing antispam and antivirus filtering before mail makes its way into Exchange. These have not been in a DMZ, and we're now making the effort to move these into a DMZ.

We use our corporate AD servers for LDAP recipient validation (so that invalid recipients are dropped). We were planning to move an LDAP server into the DMZ with the appliances, with email addresses pushed to it from production, for recipient validation. *BUT* I came across SMTP call-ahead, which seems like it would suit our needs better since we wouldn't need a dedicated LDAP server and our architecture would be more secure...

IronPort would open an SMTP session to Exchange to verify the recipient. Exchange hub servers don't do this out of the box, antispam agents need to be installed. This fellow has a good guide: This fellow has a good guide: http://www.jjclements.co.uk/2010/09/23/exchange-2010-recipient-filtering-on-a-hub-transport-server/

I'm wondering if what we're doing is a terrible idea. Does anyone have any experience with SMTP call-ahead? I would appreciate any thoughts, validation, or feedback.
ASKER CERTIFIED SOLUTION
Avatar of Simon Butler (Sembee)
Simon Butler (Sembee)
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of msghydron
msghydron

ASKER

We are proceeding with SMTP call-ahead on the IronPort C360 appliances, switching from LDAP recipient validation. We've removed the 5-second tarpit delay. I think this is a better configuration, when the C360's are in a DMZ.