Multi-domain configuration for Exchange 2013

Titonhw used Ask the Experts™
I'm having trouble setting up autodiscover for our Exchange 2013 infrastructure. We have two domains, let's call them and and both of these should be serviced by the same server, which is set up at

Autodiscover on Exchange is set up correctly for and the certificate that the Exchange server presents is a wildcard certificate for * Therefore when you add to one of our corporate mobile phones, it gets all of the user settings and correctly sets the phone up automatically.

Autodiscover for does not work under the same scenario. It reports that it cannot verify the account. If you enter the information manually, it works.

DNS is set up thus: 3600 IN CNAME 300 IN SRV 0 0 443 300 IN SRV 0 0 443

Microsoft's Remote Connectivity Analyser says that all is well. Can anyone shed any light on what I might have set up incorrectly?

Thanks in advance.

Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Saif ShaikhServer engineer

You need to create an SRV record for if that entry is not present in the current third party wildcard certificate.
Server engineer
Commented: 300 IN SRV 0 0 443

The above SRV is incorrect.

Service: _autodiscover
Protocol: _tcp
Port: 443

Note: If you are testing or configuring in Iphone then SRV record won't work as it requires autodiscover SAN entry in certificate and a host A record in public DNS>
Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018
I see the problem.

The main addresses are under your main domain, so the server is:,

Since you have a wildcard certificate you'd need just 2 records for this server (this info is already on your domain)

Now moving to the other domain,
you can't have any autodiscover record for this domain since this won't work (because you don't have a cert for this domain).
Then the solution is simply to add an SVR record in your public DNS, the values are already given by -Saif-

The point is the if you don't have a cert, you use the SVR record and all outlook clients will get this warning:
Check the "Don't ask about" and trust the cer it should be:
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!


Thank you both of you. Between the two of you, you have answered my question and explained why the answer is so.
Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018

Glad to help you tito! :)


Actually, apologies, I have a further question on this subject.

Saif has suggested that an A record is necessary in order to use Autodiscover with iPhones. When adding an CNAME record to pointing to, it causes Autodiscover to stop working on Android phones because the certificate is presented as as Jose has said above.

Is there a compromise here which will work with both? Should I for example set up the A record against with the IP addresses of

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial