split dns question and using cname instead of A records

When you say you're running "everything in Azure" that to me means you don't have a server on-prem.  Can you clarify how your network is split up?

If everything truly was hosted in Azure, the only time you would need to worry about that .local domain is if you were using some kind of VDI or DaaS solution on the same hosted network as the Exchange server.  Otherwise everything will be external by default.  I think it would be easiest to explain best practice if everything was on-prem, then make adjustments for the cloud.

SSL cert should cover mail.domain.com and autodiscover.domain.com unless you want to throw in a pop or smtp subdomain.

DNS should be an A record for mail.domain.com pointing to your Exchange server's WAN IP, and either an SRV, CNAME, or A record for autodiscover.domain.com.  I prefer CNAME unless it's a multi-tenant deployment.

All virtual directories should have an internal URL that matches the external URL, ie https://mail.contoso.com/EWS/Exchange.asmx.

Outlook Anywhere should be configured with basic and NTLM auth for IISAuthentication, and NTLM for InternalClientAuthenticationMethod.  

You can avoid the internal forward lookup zone all together with the right firewall settings.  Sonicwalls will do this out of the box, but Cicso requires a little extra configuration called DNS fixup or DNS doctoring.  Basically anytime the firewall query a DNS record that points back to itself, it stops the query before it leaves the network and redirects the connection back to the appropriate server.  Pretty cool actually.

Thank you so much.

If I understand you correctly, basically for Internal DNS:
 I need CNAME autodiscover record in my Internal DNS external forwad lookup zone externaldomain.com and DONT need CNAME in the DNS internal zone contoso.local?


How about internal DNS MX record? Should I have it in external forward lookup zone or internal forward lookup zone contoso.local in my internal DNS? Please note that all clients FQDN is computername.contoso.local (internal DNS). Do I need to add that DNS suffix to all computers as well? Or another CNAME record so that if they reach Exchange Server which also has FQDN with local domain exch2013.contoso.local to point to exch2010.externaldomain.com? Do I need to add DNS suffix to exchnage server as well?

External DNS:
CNAME Autodiscover pointing to Public IP of the VM as well as CNAME mail pointing to the same PUBLIC IP of the VM. MX record pointing to PUBLIC IP



Thanks for cert and virtual directory notes, I did set them up already.