asked on

exchange 2010: 451 4.4.0 Primary target IP address responded with "421 4.2.1 Unable to connect."

Hi experts,

I am in the process of moving to exchange 2010. I have two domains contoso.com and kontoso.com. On the exchange 2010 hub transport, I have set up two accepted domains contoso.com and kontoso.com set up on the hub transport and the mailnboxes for both contoso.com and kontoso.com set up.

The exchange 2010 points to a dual-brain DNS for contoso.com and kontoso.com initially set up to simplify look up for internal and external IP addresses. The WIndows 2008 R2 AD name is contoso.com and cannot change.

Currently kontoso.com is already moved to exchange 2010 but not contoso.com. What I need to do now is to temporarily point emails intended for contoso.com to another non-Exchange email server on the Internet until the move over to Exchange. After the following attempts I get the "451 4.4.0 Primary tartget IP address responded with "421 4.2.1 Unable to connect." Attempted failover to alternate host," message when attempting to send mail from address from kontoso.com to address to contoso.com:

1. Change the accepted domain contoso.com from authoritative to internal relay.

2. Set up a send connector for internal relay with cost=1, use DNS MX record to route email.

3. Temporarily removed the smtp addresses for mailboxes for contoso.com using EMC.

4. On the AD DNS, set up forward lookup zones MX to point to the existing mail server for relay.

I suspect the problem lies with the AD name and smtp domain name are the same as contoso.com. Since I can't change it, are there any solutions in sight for this problem? This arrangement needs to go online in this week.

Thanks all.
meinreflection

FarWest

are sending to other external domains working will?

meinreflection

ASKER

Farwest,

I have not tested it yet. The whole purpose of the arrangement is to forward all the emails intended for @contoso.com to another non Exxhange server until move over. The accounts for kontoso.com will move first so it is important for kontoso users to send email for contoso.com not to end up in exchange mbx until the move over.

FarWest

did you verify that none exchange server accessable from exchange
most of the time if you are using proxy server like tmg, you should add proxy setting to winttp using netsh, and make sure the computer account is able to access mail,dns protocol on the internet.

meinreflection

ASKER

@FarWest,

I tested and kontoso.com users can send to outside like google, but not to contoso.com.

Adam Farage

So you know the issue is most likely "contoso.com".

Two questions:

- If you run Get-TransportServer| Get-Queue where is the queue backup within the Contoso.com domain?
- Post the output of Get-TransportServer | Get-SendConnector | FL

Also how is the HUB transport server connecting to the internet outbound (is it using an MX record, or do you have a smarthost that it is connecting to first and then that is forwarding the email out via MX)?

It sounds like the smarthost may not be setup properly if there is one, or the Send connector is not proper.

meinreflection

ASKER

@Adam Farage:

The whole purpose of the set up is to temporarily bypass the Exchange mailboxes for contoso.com as they are not yet being commissioned.

One other thing the current set up is email addresses @contoso.com and @kontoso.com are under the same AD name contoso.com.

ASKER CERTIFIED SOLUTION

Adam Farage

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

meinreflection

ASKER

hi FarWest,

contoso.com is actually hkcompass.com
kontoso.com is actually prccompass.com

There is no Edge Transport Server or smarthost.

I have changed from internal relay to external relay for hkcompass.com accepted domain during troubleshooting.

It also seemed that even if I remove hkcompass.com from the accepted domain, it will still not try to route hkcompass.com email to external mail server due to it sees hkcompass.com as the AD name of the AD domain and mail just get stuck in our exchange organization.

I suspect the exchange server has not even performed nslookup or ping at all and just looked into itself internally somehow and sees hkcompass.com as the AD name and stop from looking outside of domain to deliver email address.

is this actually not achievable if I have same AD name as smtp domain name which exchange will not try to look outside at all?

I have setup all the DNS MX / A record with external IP address in the internal DNS server already but they were not being looked up.

Below are information you requested:

contoso.com is actually hkcompass.com
kontoso.com is actually prccompass.com

[PS] C:\Windows\system32>Get-TransportServer| Get-Queue

Identity DeliveryType Status MessageCount NextHopDomain
-------- ------------ ------ ------------ -------------
NTCOMV03\Submission Undefined Ready 0 Submission
NTCOMV03\Shadow\4 ShadowRed... Ready 0 ntcomv04.hkcompass.com
NTCOMV04\123 DnsConnec... Retry 4 hkcompass.com
NTCOMV04\134 DnsConnec... Retry 3 hkcompass.com
NTCOMV04\Submission Undefined Ready 0 Submission
NTCOMV04\Shadow\5 ShadowRed... Ready 0 ntcomv03.hkcompass.com

[PS] C:\Windows\system32>get-transportserver

Name MessageTrackingLogEnabled
---- -------------------------
NTCOMV03 True
NTCOMV04 True

[PS] C:\Windows\system32>get-SendConnector

Identity AddressSpaces Enabled
-------- ------------- -------
Outbound {SMTP:*;3} True
hkcompass {SMTP:*.hkcompass.com;1} True

[PS] C:\Windows\system32>

[PS] C:\Windows\system32>get-SendConnector | fl

AddressSpaces : {SMTP:*;3}
AuthenticationCredential :
Comment :
ConnectedDomains : {}
ConnectionInactivityTimeOut : 00:10:00
DNSRoutingEnabled : True
DomainSecureEnabled : False
Enabled : True
ErrorPolicies : Default
ForceHELO : False
Fqdn :
HomeMTA : Microsoft MTA
HomeMtaServerId : NTCOMV03
Identity : Outbound
IgnoreSTARTTLS : False
IsScopedConnector : False
IsSmtpConnector : True
LinkedReceiveConnector :
MaxMessageSize : 24 MB (25,165,824 bytes)
Name : Outbound
Port : 25
ProtocolLoggingLevel : None
RequireOorg : False
RequireTLS : False
SmartHostAuthMechanism : None
SmartHosts : {}
SmartHostsString :
SmtpMaxMessagesPerConnection : 20
SourceIPAddress : 0.0.0.0
SourceRoutingGroup : Exchange Routing Group (DWBGZMFD01QNBJR)
SourceTransportServers : {NTCOMV04, NTCOMV03}
TlsAuthLevel :
TlsDomain :
UseExternalDNSServersEnabled : False

AddressSpaces : {SMTP:*.hkcompass.com;1}
AuthenticationCredential :
Comment :
ConnectedDomains : {}
ConnectionInactivityTimeOut : 00:10:00
DNSRoutingEnabled : True
DomainSecureEnabled : False
Enabled : True
ErrorPolicies : Default
ForceHELO : False
Fqdn :
HomeMTA : Microsoft MTA
HomeMtaServerId : NTCOMV03
Identity : hkcompass
IgnoreSTARTTLS : False
IsScopedConnector : False
IsSmtpConnector : True
LinkedReceiveConnector :
MaxMessageSize : 10 MB (10,485,760 bytes)
Name : hkcompass
Port : 25
ProtocolLoggingLevel : None
RequireOorg : False
RequireTLS : False
SmartHostAuthMechanism : None
SmartHosts : {}
SmartHostsString :
SmtpMaxMessagesPerConnection : 20
SourceIPAddress : 0.0.0.0
SourceRoutingGroup : Exchange Routing Group (DWBGZMFD01QNBJR)
SourceTransportServers : {NTCOMV04, NTCOMV03}
TlsAuthLevel :
TlsDomain :
UseExternalDNSServersEnabled : False

[PS] C:\Windows\system32>get-transportserver | fl

RunspaceId : aff1a4cc-08b3-4c2f-a507-57304ba653fe
Name : NTCOMV03
AntispamAgentsEnabled : False
ConnectivityLogEnabled : True
ConnectivityLogMaxAge : 30.00:00:00
ConnectivityLogMaxDirectorySize : 1000 MB (1,048,576,000 bytes)
ConnectivityLogMaxFileSize : 10 MB (10,485,760 bytes)
ConnectivityLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\Connectivity
DelayNotificationTimeout : 04:00:00
ExternalDNSAdapterEnabled : True
ExternalDNSAdapterGuid : 00000000-0000-0000-0000-000000000000
ExternalDNSProtocolOption : Any
ExternalDNSServers : {}
ExternalIPAddress :
InternalDNSAdapterEnabled : True
InternalDNSAdapterGuid : 00000000-0000-0000-0000-000000000000
InternalDNSProtocolOption : Any
InternalDNSServers : {}
MaxConcurrentMailboxDeliveries : 20
MaxConcurrentMailboxSubmissions : 20
MaxConnectionRatePerMinute : 1200
MaxOutboundConnections : 1000
MaxPerDomainOutboundConnections : 20
MessageExpirationTimeout : 2.00:00:00
MessageRetryInterval : 00:01:00
MessageTrackingLogEnabled : True
MessageTrackingLogMaxAge : 30.00:00:00
MessageTrackingLogMaxDirectorySize : 1000 MB (1,048,576,000 bytes)
MessageTrackingLogMaxFileSize : 10 MB (10,485,760 bytes)
MessageTrackingLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\MessageTracking
IrmLogEnabled : True
IrmLogMaxAge : 30.00:00:00
IrmLogMaxDirectorySize : 250 MB (262,144,000 bytes)
IrmLogMaxFileSize : 10 MB (10,485,760 bytes)
IrmLogPath : D:\Program Files\Microsoft\Exchange Server\V14\Logging\IRMLogs
ActiveUserStatisticsLogMaxAge : 30.00:00:00
ActiveUserStatisticsLogMaxDirectorySize : 250 MB (262,144,000 bytes)
ActiveUserStatisticsLogMaxFileSize : 10 MB (10,485,760 bytes)
ActiveUserStatisticsLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\ActiveUsersStats
ServerStatisticsLogMaxAge : 30.00:00:00
ServerStatisticsLogMaxDirectorySize : 250 MB (262,144,000 bytes)
ServerStatisticsLogMaxFileSize : 10 MB (10,485,760 bytes)
ServerStatisticsLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\ServerStats
MessageTrackingLogSubjectLoggingEnabled : True
OutboundConnectionFailureRetryInterval : 00:10:00
IntraOrgConnectorProtocolLoggingLevel : None
PickupDirectoryMaxHeaderSize : 64 KB (65,536 bytes)
PickupDirectoryMaxMessagesPerMinute : 100
PickupDirectoryMaxRecipientsPerMessage : 100
PickupDirectoryPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Pick
up
PipelineTracingEnabled : False
ContentConversionTracingEnabled : False
PipelineTracingPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\PipelineTracing
PipelineTracingSenderAddress :
PoisonMessageDetectionEnabled : True
PoisonThreshold : 2
QueueMaxIdleTime : 00:03:00
ReceiveProtocolLogMaxAge : 30.00:00:00
ReceiveProtocolLogMaxDirectorySize : 250 MB (262,144,000 bytes)
ReceiveProtocolLogMaxFileSize : 10 MB (10,485,760 bytes)
ReceiveProtocolLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\ProtocolLog\SmtpReceive
RecipientValidationCacheEnabled : False
ReplayDirectoryPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Repl
ay
RootDropDirectoryPath :
RoutingTableLogMaxAge : 7.00:00:00
RoutingTableLogMaxDirectorySize : 50 MB (52,428,800 bytes)
RoutingTableLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\Routing
SendProtocolLogMaxAge : 30.00:00:00
SendProtocolLogMaxDirectorySize : 250 MB (262,144,000 bytes)
SendProtocolLogMaxFileSize : 10 MB (10,485,760 bytes)
SendProtocolLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\ProtocolLog\SmtpSend
TransientFailureRetryCount : 6
TransientFailureRetryInterval : 00:05:00
AntispamUpdatesEnabled : False
InternalTransportCertificateThumbprint : 3E8F567FBF902715B42318F68EDD9A245BB0EB89
TransportSyncEnabled : False
TransportSyncPopEnabled : False
WindowsLiveHotmailTransportSyncEnabled : False
WindowsLiveContactTransportSyncEnabled : False
TransportSyncExchangeEnabled : False
TransportSyncImapEnabled : False
MaxNumberOfTransportSyncAttempts : 3
MaxActiveTransportSyncJobsPerProcessor : 16
HttpTransportSyncProxyServer :
HttpProtocolLogEnabled : False
HttpProtocolLogFilePath :
HttpProtocolLogMaxAge : 7.00:00:00
HttpProtocolLogMaxDirectorySize : 250 MB (262,144,000 bytes)
HttpProtocolLogMaxFileSize : 10 MB (10,485,760 bytes)
HttpProtocolLogLoggingLevel : None
TransportSyncLogEnabled : False
TransportSyncLogFilePath :
TransportSyncLogLoggingLevel : None
TransportSyncLogMaxAge : 30.00:00:00
TransportSyncLogMaxDirectorySize : 10 GB (10,737,418,240 bytes)
TransportSyncLogMaxFileSize : 10 MB (10,485,760 bytes)
TransportSyncHubHealthLogEnabled : False
TransportSyncHubHealthLogFilePath :
TransportSyncHubHealthLogMaxAge : 30.00:00:00
TransportSyncHubHealthLogMaxDirectorySize : 10 GB (10,737,418,240 bytes)
TransportSyncHubHealthLogMaxFileSize : 10 MB (10,485,760 bytes)
TransportSyncAccountsPoisonDetectionEnabled : False
TransportSyncAccountsPoisonAccountThreshold : 2
TransportSyncAccountsPoisonItemThreshold : 2
TransportSyncAccountsSuccessivePoisonItemThreshold : 3
TransportSyncRemoteConnectionTimeout : 00:01:40
TransportSyncMaxDownloadSizePerItem : 25 MB (26,214,400 bytes)
TransportSyncMaxDownloadSizePerConnection : 50 MB (52,428,800 bytes)
TransportSyncMaxDownloadItemsPerConnection : 1000
DeltaSyncClientCertificateThumbprint :
UseDowngradedExchangeServerAuth : False
IntraOrgConnectorSmtpMaxMessagesPerConnection : 20
IsValid : True
ExchangeVersion : 0.1 (8.0.535.0)
DistinguishedName : CN=NTCOMV03,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF2
3SPDLT),CN=Administrative Groups,CN=HKCompass,CN=Microsoft Exchang
e,CN=Services,CN=Configuration,DC=hkcompass,DC=com
Identity : NTCOMV03
Guid : e2cb72f8-e56e-41f5-aac9-c4141534e59e
ObjectCategory : hkcompass.com/Configuration/Schema/ms-Exch-Exchange-Server
ObjectClass : {top, server, msExchExchangeServer}
WhenChanged : 6/25/2013 11:24:31 PM
WhenCreated : 6/20/2013 6:39:12 PM
WhenChangedUTC : 6/25/2013 3:24:31 PM
WhenCreatedUTC : 6/20/2013 10:39:12 AM
OrganizationId :
OriginatingServer : NTCOMV02.hkcompass.com

RunspaceId : aff1a4cc-08b3-4c2f-a507-57304ba653fe
Name : NTCOMV04
AntispamAgentsEnabled : False
ConnectivityLogEnabled : True
ConnectivityLogMaxAge : 30.00:00:00
ConnectivityLogMaxDirectorySize : 1000 MB (1,048,576,000 bytes)
ConnectivityLogMaxFileSize : 10 MB (10,485,760 bytes)
ConnectivityLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\Connectivity
DelayNotificationTimeout : 04:00:00
ExternalDNSAdapterEnabled : True
ExternalDNSAdapterGuid : 00000000-0000-0000-0000-000000000000
ExternalDNSProtocolOption : Any
ExternalDNSServers : {}
ExternalIPAddress :
InternalDNSAdapterEnabled : True
InternalDNSAdapterGuid : 00000000-0000-0000-0000-000000000000
InternalDNSProtocolOption : Any
InternalDNSServers : {}
MaxConcurrentMailboxDeliveries : 20
MaxConcurrentMailboxSubmissions : 20
MaxConnectionRatePerMinute : 1200
MaxOutboundConnections : 1000
MaxPerDomainOutboundConnections : 20
MessageExpirationTimeout : 2.00:00:00
MessageRetryInterval : 00:01:00
MessageTrackingLogEnabled : True
MessageTrackingLogMaxAge : 30.00:00:00
MessageTrackingLogMaxDirectorySize : 1000 MB (1,048,576,000 bytes)
MessageTrackingLogMaxFileSize : 10 MB (10,485,760 bytes)
MessageTrackingLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\MessageTracking
IrmLogEnabled : True
IrmLogMaxAge : 30.00:00:00
IrmLogMaxDirectorySize : 250 MB (262,144,000 bytes)
IrmLogMaxFileSize : 10 MB (10,485,760 bytes)
IrmLogPath : D:\Program Files\Microsoft\Exchange Server\V14\Logging\IRMLogs
ActiveUserStatisticsLogMaxAge : 30.00:00:00
ActiveUserStatisticsLogMaxDirectorySize : 250 MB (262,144,000 bytes)
ActiveUserStatisticsLogMaxFileSize : 10 MB (10,485,760 bytes)
ActiveUserStatisticsLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\ActiveUsersStats
ServerStatisticsLogMaxAge : 30.00:00:00
ServerStatisticsLogMaxDirectorySize : 250 MB (262,144,000 bytes)
ServerStatisticsLogMaxFileSize : 10 MB (10,485,760 bytes)
ServerStatisticsLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\ServerStats
MessageTrackingLogSubjectLoggingEnabled : True
OutboundConnectionFailureRetryInterval : 00:10:00
IntraOrgConnectorProtocolLoggingLevel : None
PickupDirectoryMaxHeaderSize : 64 KB (65,536 bytes)
PickupDirectoryMaxMessagesPerMinute : 100
PickupDirectoryMaxRecipientsPerMessage : 100
PickupDirectoryPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Pick
up
PipelineTracingEnabled : False
ContentConversionTracingEnabled : False
PipelineTracingPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\PipelineTracing
PipelineTracingSenderAddress :
PoisonMessageDetectionEnabled : True
PoisonThreshold : 2
QueueMaxIdleTime : 00:03:00
ReceiveProtocolLogMaxAge : 30.00:00:00
ReceiveProtocolLogMaxDirectorySize : 250 MB (262,144,000 bytes)
ReceiveProtocolLogMaxFileSize : 10 MB (10,485,760 bytes)
ReceiveProtocolLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\ProtocolLog\SmtpReceive
RecipientValidationCacheEnabled : False
ReplayDirectoryPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Repl
ay
RootDropDirectoryPath :
RoutingTableLogMaxAge : 7.00:00:00
RoutingTableLogMaxDirectorySize : 50 MB (52,428,800 bytes)
RoutingTableLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\Routing
SendProtocolLogMaxAge : 30.00:00:00
SendProtocolLogMaxDirectorySize : 250 MB (262,144,000 bytes)
SendProtocolLogMaxFileSize : 10 MB (10,485,760 bytes)
SendProtocolLogPath : D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs
\ProtocolLog\SmtpSend
TransientFailureRetryCount : 6
TransientFailureRetryInterval : 00:05:00
AntispamUpdatesEnabled : False
InternalTransportCertificateThumbprint : 6BA321BAC0F3E9D13090CD707AC9CB74F0E029B3
TransportSyncEnabled : False
TransportSyncPopEnabled : False
WindowsLiveHotmailTransportSyncEnabled : False
WindowsLiveContactTransportSyncEnabled : False
TransportSyncExchangeEnabled : False
TransportSyncImapEnabled : False
MaxNumberOfTransportSyncAttempts : 3
MaxActiveTransportSyncJobsPerProcessor : 16
HttpTransportSyncProxyServer :
HttpProtocolLogEnabled : False
HttpProtocolLogFilePath :
HttpProtocolLogMaxAge : 7.00:00:00
HttpProtocolLogMaxDirectorySize : 250 MB (262,144,000 bytes)
HttpProtocolLogMaxFileSize : 10 MB (10,485,760 bytes)
HttpProtocolLogLoggingLevel : None
TransportSyncLogEnabled : False
TransportSyncLogFilePath :
TransportSyncLogLoggingLevel : None
TransportSyncLogMaxAge : 30.00:00:00
TransportSyncLogMaxDirectorySize : 10 GB (10,737,418,240 bytes)
TransportSyncLogMaxFileSize : 10 MB (10,485,760 bytes)
TransportSyncHubHealthLogEnabled : False
TransportSyncHubHealthLogFilePath :
TransportSyncHubHealthLogMaxAge : 30.00:00:00
TransportSyncHubHealthLogMaxDirectorySize : 10 GB (10,737,418,240 bytes)
TransportSyncHubHealthLogMaxFileSize : 10 MB (10,485,760 bytes)
TransportSyncAccountsPoisonDetectionEnabled : False
TransportSyncAccountsPoisonAccountThreshold : 2
TransportSyncAccountsPoisonItemThreshold : 2
TransportSyncAccountsSuccessivePoisonItemThreshold : 3
TransportSyncRemoteConnectionTimeout : 00:01:40
TransportSyncMaxDownloadSizePerItem : 25 MB (26,214,400 bytes)
TransportSyncMaxDownloadSizePerConnection : 50 MB (52,428,800 bytes)
TransportSyncMaxDownloadItemsPerConnection : 1000
DeltaSyncClientCertificateThumbprint :
UseDowngradedExchangeServerAuth : False
IntraOrgConnectorSmtpMaxMessagesPerConnection : 20
IsValid : True
ExchangeVersion : 0.1 (8.0.535.0)
DistinguishedName : CN=NTCOMV04,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF2
3SPDLT),CN=Administrative Groups,CN=HKCompass,CN=Microsoft Exchang
e,CN=Services,CN=Configuration,DC=hkcompass,DC=com
Identity : NTCOMV04
Guid : d70f1b85-d761-47a2-940b-a908d93b0c4d
ObjectCategory : hkcompass.com/Configuration/Schema/ms-Exch-Exchange-Server
ObjectClass : {top, server, msExchExchangeServer}
WhenChanged : 6/25/2013 11:26:39 PM
WhenCreated : 6/20/2013 7:23:57 PM
WhenChangedUTC : 6/25/2013 3:26:39 PM
WhenCreatedUTC : 6/20/2013 11:23:57 AM
OrganizationId :
OriginatingServer : NTCOMV02.hkcompass.com

meinreflection

ASKER

The whole reason for going through all this troubleshooting is to try to set up a temporary "bypass" for mailboxes with @hkcompass.com SMTP domain which are not yet being commissioned. However I can't seem to route the email from Exchange 2010 to the email server currently being used, and to prevent email from @prccompass.com SMTP domains being sent to @hkcompass.com being routed to the Exchange 2010 server.

I think there should be another way of setting up the "bypass". Would having the same name for AD domain and SMTP domain be a show stopper?

meinreflection

ASKER

What I did was set the smart host to use the external IP address for now, and then renamed the mailbox external addresses so that it will be bypassed.

exchange 2010: 451 4.4.0 Primary target IP address responded with &quot;421 4.2.1 Unable to connect.&quot;

exchange 2010: 451 4.4.0 Primary target IP address responded with "421 4.2.1 Unable to connect."