This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Recipient Verification with Exchange 2013

Using callout doesn't work anymore. As mentioned here

exchange 2013 recipient filtering

the recipient filter works different as in Ex2010:

I have also noticed that Recipientfiltering doesn't work exactly the same way as in EX07/EX10.
When enabled, you should get an 550 5.1.1 User unknown after the ending period (see below)

mail from:
250 2.1.0 Sender OK
rcpt to:
250 2.1.5 Recipient OK
data
354 Start mail input; end with .
Write some Text Here
.
550 5.1.1 User unknown

Is this a known issue for development?

This thread was automatically locked due to age.

Parents

0 toltol over 10 years ago
Here is the reason for this behaviour:

exchange 2013 recipient filtering

(...) this is expected in Exchange 2013. Recipient Filtering is only present on Mailbox server role. Client Access Role will proxy SMTP session to Mailbox server but CAS will not effectively manage the Recipient filtering part.

In fact, CAS needs the RCPT TO information in order to determine the best Mailbox Server to which it can proxy connection to. Connection from CAS to MBX will be established only after DATA being received by CAS from external SMTP server. CAS will pass to Mailbox server SMTP commands it received from external SMTP server. That is why you observe that "User unknown" only at the very end of the session.

and the workaround:

The workaround is to create a new receive connector of type HubTransport scoped for the IP addresses of your front-end MTA's. Limiting the scope will cause them to be used. HubTransport receive connectors do recipient validation correctly just like previous version of Exchange.

Testing it with the default HubTransport connector listening on 2525 (have to enable anonymous access on this connector):

sophos:/root # telnet ex2013.company.de 2525
Trying 192.168.***.***...
Connected to ex2013.company.de.
Escape character is '^]'.
220 ex2013.company.de Microsoft ESMTP MAIL Service ready at Tue, 18 Mar 2014 20:39:41 +0100
ehlo local
250-ex2013.company.de Hello [192.168.***.***]
250-SIZE
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-STARTTLS
250-X-ANONYMOUSTLS
250-AUTH NTLM
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOWREQUEST
mail from:toltol@external.com
250 2.1.0 Sender OK
rcpt to:sadfasdf@company.de
550 5.1.1 User unknown
....

So you can add another HubTransport connector on port 25 just for your UTM (configured in the RemoteIPRanges) and use callout as with EX2010.
Of course you have to setup recipient filtering as described above too.

Tobias
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 toltol over 10 years ago
Here is the reason for this behaviour:

exchange 2013 recipient filtering

(...) this is expected in Exchange 2013. Recipient Filtering is only present on Mailbox server role. Client Access Role will proxy SMTP session to Mailbox server but CAS will not effectively manage the Recipient filtering part.

In fact, CAS needs the RCPT TO information in order to determine the best Mailbox Server to which it can proxy connection to. Connection from CAS to MBX will be established only after DATA being received by CAS from external SMTP server. CAS will pass to Mailbox server SMTP commands it received from external SMTP server. That is why you observe that "User unknown" only at the very end of the session.

and the workaround:

The workaround is to create a new receive connector of type HubTransport scoped for the IP addresses of your front-end MTA's. Limiting the scope will cause them to be used. HubTransport receive connectors do recipient validation correctly just like previous version of Exchange.

Testing it with the default HubTransport connector listening on 2525 (have to enable anonymous access on this connector):

sophos:/root # telnet ex2013.company.de 2525
Trying 192.168.***.***...
Connected to ex2013.company.de.
Escape character is '^]'.
220 ex2013.company.de Microsoft ESMTP MAIL Service ready at Tue, 18 Mar 2014 20:39:41 +0100
ehlo local
250-ex2013.company.de Hello [192.168.***.***]
250-SIZE
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-STARTTLS
250-X-ANONYMOUSTLS
250-AUTH NTLM
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOWREQUEST
mail from:toltol@external.com
250 2.1.0 Sender OK
rcpt to:sadfasdf@company.de
550 5.1.1 User unknown
....

So you can add another HubTransport connector on port 25 just for your UTM (configured in the RemoteIPRanges) and use callout as with EX2010.
Of course you have to setup recipient filtering as described above too.

Tobias
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data