Multi-domain configuration for Exchange 2013

I'm having trouble setting up autodiscover for our Exchange 2013 infrastructure. We have two domains, let's call them domain.co.uk and domain.com and both of these should be serviced by the same server, which is set up at mail.domain.co.uk.

Autodiscover on Exchange is set up correctly for domain.co.uk and the certificate that the Exchange server presents is a wildcard certificate for *.domain.co.uk. Therefore when you add email@domain.co.uk to one of our corporate mobile phones, it gets all of the user settings and correctly sets the phone up automatically.

Autodiscover for domain.com does not work under the same scenario. It reports that it cannot verify the account. If you enter the information manually, it works.

DNS is set up thus:

autodiscover.domain.co.uk 3600 IN CNAME mail.domain.co.uk
_autodiscover._tcp.domain.co.uk 300 IN SRV 0 0 443 mail.domain.co.uk

_autodiscover._tcp.domain.com 300 IN SRV 0 0 443 autodiscover.domain.co.uk

Microsoft's Remote Connectivity Analyser says that all is well. Can anyone shed any light on what I might have set up incorrectly?

Thanks in advance.

Phil
TitonhwAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Saif ShaikhServer engineer Commented:
You need to create an SRV record for domain.com if that entry is not present in the current third party wildcard certificate.
Saif ShaikhServer engineer Commented:
_autodiscover._tcp.domain.com 300 IN SRV 0 0 443 autodiscover.domain.co.uk

The above SRV is incorrect.

Service: _autodiscover
Protocol: _tcp
Host: domain.com
Port: 443
Target: mail.domain.co.uk

Note: If you are testing or configuring in Iphone then SRV record won't work as it requires autodiscover SAN entry in certificate and a host A record in public DNS>

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Jose Gabriel Ortega CastroEE Rookie/Solution Guide/Topic Advisor and CEO Faru Bonon ITCommented:
I see the problem.

The main addresses are under your main domain, so the server is:
mail.domain.co.uk,

Since you have a wildcard certificate you'd need just 2 records for this server (this info is already on your domain)
autodiscover.domain.co.uk
mail.domain.co.uk

Now moving to the other domain, domain.com
you can't have any autodiscover record for this domain since this won't work (because you don't have a cert for this domain).
Then the solution is simply to add an SVR record in your public DNS, the values are already given by -Saif-

The point is the if you don't have a cert, you use the SVR record and all outlook clients will get this warning:
image_thumb20_thumb-1-.png
Check the "Don't ask about" and trust the cer it should be:
https://mail.domain.co.uk/autodiscover/autodiscover.xml
Your Guide to Achieving IT Business Success

The IT Service Excellence Tool Kit has best practices to keep your clients happy and business booming. Inside, you’ll find everything you need to increase client satisfaction and retention, become more competitive, and increase your overall success.

TitonhwAuthor Commented:
Thank you both of you. Between the two of you, you have answered my question and explained why the answer is so.
Jose Gabriel Ortega CastroEE Rookie/Solution Guide/Topic Advisor and CEO Faru Bonon ITCommented:
Glad to help you tito! :)
TitonhwAuthor Commented:
Actually, apologies, I have a further question on this subject.

Saif has suggested that an A record is necessary in order to use Autodiscover with iPhones. When adding an CNAME record to domain.com pointing to mail.domain.co.uk, it causes Autodiscover to stop working on Android phones because the certificate is presented as .co.uk as Jose has said above.

Is there a compromise here which will work with both? Should I for example set up the A record against domain.com with the IP addresses of mail.domain.co.uk?
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.