Public DNS record for Exchange 2013 server

Posted on 2014-10-15
Medium Priority
Last Modified: 2014-10-16

I hope someone can help. With a bit of investigation, I'm sure I could source the answer to this but am in need of a quick fix hence posting this question.

I use an Exchange 2013 server purely for relaying mail from applications and services. Mails to one domain are failing with the error:

450 4.7.1 <server.domain.net>: Helo command rejected: Host not found

I have been told by the recipients that this is happening because the FQDN of our server does not resolve to a public IP address. So, my first question is, what type of record needs to be created for this? An A record I presume? We have public IP's available.

Secondly, when I have requested this record to be created I have been asked what inbound ports need to be allowed. Is there a simple list of these? I would presume: 25,443,80,465,993. Any others?

Thanks, and sorry for the slightly dumb questions.
Question by:ishamsi
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 36

Accepted Solution

Kimputer earned 1400 total points
ID: 40381828
You should actually know what your HELO command is to start solving this.
Assuming it's properly named as your FQDN, like mailserver.domain.com, you usually set an A record for mailserver.domain.com to your public facing IP number.
HOWEVER, some servers will double check, the reverse DNS. That one you cannot solve by yourself. Some servers will now do a lookup for your public IP number, and only allow further communication if it matches the A lookup earlier. Since you don't own the IP number, the company that does (your ISP probably) will have to set a reverse DNS entry for you (they might charge you some administration costs).
The reasoning is that you are putting quite an effort to get these records straightened out, while a spammer cannot get this done.
Your inbound ports are as follows:
25 incoming mail - plain text SMTP protocol
80 http
443 https
465 SMTPS (secure smtp, SSL enabled)
993 secure IMAP

Only 25 is important for incoming mail. The rest are for your clients retrieving their mail, but it's not necessary if they don't need to use it outside the office.
LVL 34

Expert Comment

ID: 40381987
Along the lines of what Kimputer has stated.  You would use the Set-ReceiveConnector commandlet, e.g. -
Get-ReceiveConnector "EX2K13ServerName\Default Frontend EX2K13ServerName" | Set-ReceiveConnector -fqdn "mail.contoso.com"

Open in new window

I have also read that if you are in a single Exchange environment, you will want to disable 'Exchange Server Authentication' on the 'Default Frontend EX2K13ServerName' connector.

That too can be accomplished with the same commandlet, e.g. -
Get-ReceiveConnector "EX2K13ServerName\Default Frontend EX2K13ServerName" | Set-ReceiveConnector -fqdn "mail.contoso.com" -AuthMechanism Tls, Integrated, BasicAuth, BasicAuthRequireTLS

Open in new window

Changing FQDN on EHLO for External:

Setting up Authenticated SMTP relaying in Exchange 2013:

LVL 35

Assisted Solution

by:Seth Simmons
Seth Simmons earned 600 total points
ID: 40382085
you will definitely need 25 as a starter
web server ports should only be exposed if this is has the CAS role and you are allowing users to access OWA
465 and 993 only if you are actually using those services
in addition to the PTR  (reverse DNS record created by your ISP) mentioned earlier, good idea to add SPF record (a TXT record in DNS) as some recipients do check that to verify that server is authoritative to send for that domain

Sender Policy Framework

Author Comment

ID: 40383837
Thanks for the comments everyone. For me, it was fairly simple. I got the firewall guy to map the internal IP of the server to one of our public IPs. He opened inbound ports 25, 443, 80, 465. After this I could telnet to the server from outside our network, using it's IP address. One thing to note was that, the IP he address he mapped it to was different to that which was previously added as a PTR record with our ISP. So I contacted the ISP and got them to change that. I then put an A record in our public DNS that resolves the (new) public IP to the FQDN of the server.

I think one of the things that threw me is that domain suffix of our internal domain is different to our public facing domain and as such, I had never had to create public DNS records for it.

Thanks for the help everyone.

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article lists the top 5 free OST to PST Converter Tools. These tools save a lot of time for users when they want to convert OST to PST after their exchange server is no longer available or some other critical issue with exchange server or impor…
A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question