SAN for accepted domain

I'm absorbing a company into our exchange and added them as an accepted domain. There current certificate is pretty standard mail and autodiscover SAN names. Currently RPC over http is not working correctly and that is to be expected since I
pointed there DNS record for autodiscover to my server. I don't have autodiscover.theircompany.com in my certificate, so it's trying to resolve a name that doesn't exist. My question is should I add a SAN name for autodiscover.theircompany.com
to get RPC over HTTP to work correctly?
My SAN names would then look like this:
mail.mycompany.com
autodiscover.mycompany.com
legacy.mycompany.com
autodiscover.theircompany.com
Would this be accurate or is there a better method?
Thanks!

Hi minor,
you do not need to worry about SAN if you used the SRV record for autodiscover.
http://blogs.technet.com/b/rmilne/archive/2014/10/02/how-to-check-exchange-autodiscover-srv-record-using-nslookup.aspx
So if you already had
mail.mycompany.com
autodiscover.mycompany.com
legacy.mycompany.com
on your certificate I suggest to not add another SAN entry, just create a new SRV record _autodiscover._tcp.theirdomain.com in your DNS zone with the following information:
Service_autodiscover
Protocol_tcp
Name theirdomain.com
priority 10
Port443
Targetmail.mycompany.com
TTL 10
Priority and TTL need to be adjusted to your needs. So you can use your existing certificate also for the new domain.
Regards,
Martin

Similar Messages

Accepted domains in Exchange SAN certificate

Hi All,
I am having few queries please clarify me .
In my environment ,i having the accepted domains list like below
xyz.com
abc.com
All the users in my organisation is having the primary smtp address as [email protected] and secondary smtp address as [email protected]
In my san certificate i am not having any of the above mentioned accepted domains.
Do i need to have all the accepted domains on the SAN certificate or else only primary smtp address domain suffix is enough ?
In case if don't have any of my accepted domains suffixes in SAN certificate what will happen ? Because why i am asking is i am not getting any certificate related errors ?
As an additional info , we are using the single namespace for exchange services like owa ,activesync ,pop/imap and outlook anywhere (both internal & external ) and that name is available in my SAN certificate.
Autodiscover namespace is also included in my SAN certificate .
Thanks S.Nithyanandham

Hi Imkottees,
Thanks a lot for your immediate response.
But still i am having some queries please explain me what you are trying to explain on this below line ?
"But you need this for all Primary domains used in your environment"
Regards
S.Nithyanandham
Thanks S.Nithyanandham

Best Migration Method for Exchange 2007 with multiple accepted domains

We are trying to determine which method would be best for us as we migrate to O365. Scenario as follows:
1) Multiple accepted domains (each in their own OU in AD); example: domainA.com, domainB.com
2) Exchange is 2007; clients will be upgrading the Outlook 2013
3) Would like to be able to sync mailboxes starting anytime but be able to cut over a domain at a time.
Tested so far with staged migration but it appears that with this, there is a change in the TargetAddress sending all mail to the O365. Even changing MXs didn't redirect the message as it reaches the Exchange box and immediately goes to O365.
We haven't tried the cutover as we're only able to test with the production box and if that somehow cutover the entire box, we'd be .. well, it wouldn't be good.
Anyone had any experience so that our #3 point would be doable, that would be great.
Thx
George

Hi George,
According to your description, I understand that the issue is related to Exchange migration from Exchange 2007 to Exchange Online for Office 365. This forum focuses on some general discussion about Office 365 ProPlus which
is the version of Office that comes with many Office 365 plans. Therefore, I suggest we can post the issue in Microsoft Exchange Online (Office 365) forum for more professional suggestions:
http://social.technet.microsoft.com/Forums/en-US/home?forum=onlineservicesexchange
Hope you can find the solution soon.
Regards,
Winnie Liang
TechNet Community Support

Configure Outlook Anywhere with 2 Accepted Domains?

Hello everybody,
I want to configure outlook anywhere for exchange organization, I have 2 accepted domains: domain1.com and domain2.com, can you guide me the best practice procedure to enable it? How many certificates? What are the SANs sghould be included in the certificate?
And how to publish it?
Thanks
Regards

hi Anas...ok to start with ..the way i do this is mentioned in below points. Please check.
1. configure the second domain in my AD (domains and trust) for users to login with their respective domain instead of all login to OWA or outlook anywhere from the parent domain
2. configure internal DNS
3. configure accepted domains
4. external DNS - public MX and A records
5. SSL would need autodiscover for sure.. and if you want to protect other domain-2 then i would do it in below manner.
autodiscover.domain1.com
mail.domain1.com
mail.domain2.com (for both domains to have their own OWA or ECP)
Let me know if this helps. where you want to publish.. firewall or CAS...?? CAS would be easy for firewall let me know which firewall.
****EDITED as per ED and MAS comments.. :) thanks guys
Mark as useful or answered if my replies helped you solving your query.
Thanks, Happiness Always
Jatin
Skype: jatider2jatin, Email: [email protected]

Exchange 2013 sp1 smtp NTLM auth for child domain users

i have exchange organization with exchange 2007 sp 3 & exchange 2013 sp1.
there are all users in Exchange 2013 server (mail flow is through Exchange 2013 server)
i have single forest, 2 site (site1, site2), root domain root.local and 1 child domain ch.root.local
DC for child domain is located in site2 (dc.ch.root.local)
multirole exchange 2013 server is installed in root domain.
i am traing to configure smtp receive connector with NTLM auth and have one problem.
when user in child domain try send email through this receive connector i see in log
<,AUTH NTLM,
>,334 <authentication response>,
*,SMTPSubmit SMTPAcceptAnyRecipient BypassAntiSpam AcceptRoutingHeaders,Set Session Permissions
*,CH\user1,authenticated
*,,Setting up client proxy session failed with error: 535 5.7.3 Unable to proxy authenticated session because either the backend does not support it or failed to resolve the user
*,,"Setting up client proxy session failed with error: 451 4.4.0 Primary target IP address responded with: ""535 5.7.3 Unable to proxy authenticated session because either
the backend does not support it or failed to resolve the user."" Attempted failover to alternate host, but that did not succeed. Either there are no alternate hosts, or delivery failed to all alternate hosts. The last endpoint attempted was 192.168.1.15:465"
but authentication is succesfull for users from root domain.
why do it can be?
Thanks.

thanks for link
at smtp receive logs (Hub transport role) i've found the next:
Client Proxy EXMAIL2013,08D134DAF6CE1C51,49,192.168.1.15:465,
*,NT AUTHORITY\SYSTEM,authenticated
>,235 <authentication response>,
<,XPROXY SID=08D130D354F520D1 IP=192.168.1.21 PORT=57085 DOMAIN=[192.168.1.21] CAPABILITIES=0 SECID=Uy0xxx...
*,,Error while looking up SamAccountName chuser: The user name or password is incorrect.\r\n
*,None,Set Session Permissions
>,250 XProxy accepted but user identity could not be obtained,

Can't setup scan to email with google apps for your domain (HP Officejet Pro 8500 A910 Printer)

Printer HP Officejet Pro 8500 A910
Web interface (HPLIP installed on ubuntu 11.10, but problem is linked to web config.)
"The device could not send the test e-mail message. (EmailAccounts-timeout)" when going through the full setup, and "The device could not send the test e-mail message." when testing the account after creating it from the "Outgoing Email Profiles" tab.
No changes.
I can't cofigure the printer to send emails out using the email adress we have created exclusively for it with our domain name in Google Apps for your domain. The settings test ok for the email alerts.
I'm using these settings:
Server: smtp.google.com
Port: 587 (also tried 465)
username: [email protected]
good password, copied and pasted to make sure there are no typo's.

Welcome to the forums Joanda!
I saw your post about the issues you are having with scanning and would like to help!
Please let me know which model of printer you have:
HP Officejet Pro 8500A e-All-in-One Printer - A910a
HP Officejet Pro 8500A Plus e-All-in-One Printer - A910g
HP Officejet Pro 8500A Premium e-All-in-One Printer - A910n
Also let me know which operating system you are running on your computer.
Thank you!
R a i n b o w 7000I work on behalf of HP
Click the “Kudos Thumbs Up" at the bottom of this post to say
“Thanks” for helping!
Click “Accept as Solution” if you feel my post solved your issue, it will help others find the solution!

Exchange 2010 accepted domain and email address policy

So I need some help as to which accepted domain is right for us. We are a single forest single domain that is subbed to a parent domain.
sub.domain.com
We run our own exchange 2010 separate from domain.com. We want all mail to show up as @domain.com for our users. The @domain.com will be configured to forward to @sub.domain.com. This is free Linux mail server that is separate from us.
In order to configure an email address policy for @domain.com I need to pick from the 3 types. I am pretty sure we are not authoritative for @domain.com (they are the parent). So it is either an internal relay or external relay. We all
use the same networking, and our DNS servers point to domain.com as forwarders and they host a secondary copy of our DNS.
It is a little unclear as to which to use. I have gone to each account individually to test, and that works perfectly, but I would like to set this Globally.
Thanks
Tim

Hello,
Thank you for your post.
This is a quick note to let you know that we are performing research on this issue.
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Simon Wu
TechNet Community Support

How to force Outlook's Junk email fitler to not filter Exchange 2010 SP1 accepted domains?

Hello,
I wonder if there really is no way how to reach the result described in the title question. Because
http://support.microsoft.com/kb/2458522 says:
This issue occurs because of a functionality change that is introduced in Exchange Server 2010 SP1. In Exchange Server 2010 SP1, domains that are configured as accepted domains are no longer allowed in the junk email lists of a mailbox.
So please tell us Microsoft how can we force Outlook to accept internal domain as a trusted senders and not apply Junk email filter on it?
There was already a long discussion about the steps here
http://social.technet.microsoft.com/Forums/en-US/outlook/thread/15f857c6-0ed4-4004-9d90-cb5d16361752 so please don't offer anything described there.
Thank you,

Trying to deal with the Outlook Junk Email Filter is not very easy and had been a pain in the butt.
The ONLY way to ensure the Outlook 2010 Junk Email filter honors "white listed" emails is to stamp the email with SCL -1. Setting a transport rule will do that but it is not very flexible.
I was able to resolve these issues by simply enabling the Exchange 2010 Anti-Spam agents on each hub transport server. We have no Edge Server but we use a couple of Ironports at the gateway which provide the bulk of AntiSpam. We didn't think we would
need the Exchange AntiSpam so we hadn't initially enabled. After months of trying to resolve people's complaints of emails from internal system ending up in Junk, this solution worked for us.
This is the order in which it was done.
1. We set the receive connectors for the internal systems for bypassing Anti Spam. We basically have 2 receive connectors, one for internal system with no relay, and one for internal systems who are allowed external relay.
Get-ReceiveConnector "server\name of the recieve connector" | Add-ADPermission -User "“NT Authority\Anonymous Logon” -AccessRights ExtendedRight
-ExtendedRights ms-exch-bypass-anti-spam
Note: If you use SMTP Authentication, Exchange will only mark the emails as "Internal" and not assign a SCL of -1. It can only be on anonymous connections.
Note: We have a separate receive connector for the Ironports delivering external email that will not bypass Anti-Spam. These emails will receive a SCL rating of 0-9
2. We set the global SCL to 6 (default is 4). You can set it to whatever you want.
Set-OrganizationConfig -SCLJunkThreshold 6
So basically, any email tagged with SCL 7-9 will be moved to Junk by Exchange.
3. Set-ContentFilterConfig -SCLQuarantineEnabled $False -SCLDeleteEnabled $False -SCLRejectEnabled $False
We don't want delete, reject or quarantine anything on Exchange. Just move email to Junk folder if SCL 7-9 and have user deal with it.
4. Set the Internal SMTP Servers by adding each Exchange server's IP Address to the Global Transport Settings. I used EMC, Organization Config, Global Settings, Transport Settings properties, Message Delivery tab. Do NOT add any other "internal" servers
here, only the Exchange servers.
5. Then we installed the AS agents on each HT Server.
Starting with the first server
Stop MSExchange Transport service
D:\Program Files\Microsoft\Exchange Server\V14\Scripts>.\install-AntispamAgents.ps1
After installation, disable all the agents except for Content Filtering Agent. This agent has to be enabled for Exchange to stamp the email with SCL -1. I used EMC, Organization Config, Hub Transport. You will see a new tab called Anti-Spam. Disable everything
except Content Filtering.
Start MSExchange Transport service.
Repeat on each HT server. (You won't have to repeat the disabling of the agents as that is a global setting)
6. You can add global safe senders by doing the following.
$list = (Get-ContentFilterConfig).BypassedSenders
$list
$list.add("[email protected]")
$list.add("[email protected]")
Set-ContentFilterConfig -BypassedSenders $list
The message headers are stamped with
For emails sent through the Internal connector
X-MS-Exchange-Organization-Antispam-Report: MessageSecurityAntispamBypass
X-MS-Exchange-Organization-SCL: -1
OR
For external emails from a safe sender
X-MS-Exchange-Organization-Antispam-Report: ContentFilterConfigBypassedSender
X-MS-Exchange-Organization-SCL: -1
OR
For all other external emails
X-MS-Exchange-Organization-SCL: 0
Good Luck. This has basically stopped all the calls about "legitimate" email in Junk Email folder.

Deliver to an email whose address is not listed as accepted domain

Hi Exchange experts!
I have a question regarding transport servers behaviour for smtp addresses that are not listed in accepted domains.
I have a mailbox with a secondary smtp address :
[email protected] , and aaaa.com is not listed as accepted.
Assuming that mx record for aaaa.com is configured correctly with my server IP. I tried sending an email to that address and it is delivred. This made me confused about my little knowledge. I thought exchange would reject such connection.
Can any one help me to understand this behaviour? (antispam agents are disabled and forefront protection for exchange is installed on hub server.)
Thanks in advance!

Hello,
I mean your organization public domain name （external domain name).
Based on my known, I understand that if we use e-mail address policy to assign e-mail address to users, such as aaaa.com, the aaaa.com must be included in accepted domain.
If we customize an e-mail address for a user mailbox ([email protected]), we can add aaaa.com as accepted domain, or needn't add it.
Only if there is a DNS MX record on public DNS server, we can send message to the user with
[email protected]
If I have any misunderstanding, please free let me know.
Cara Chen
TechNet Community Support

Mail Receive from outside in Exchange server 2010 (Accepted Domain)

Hello All
Two Exchange 2010 server running existing environment. in front of two exchange server have McAfee firewall. This McAfee Firewall receive the mail from outside and send it to Exchange 2010 server.
for example abc.com is working well to send and receive mail using exchange server. recently i have add
Accepted Domain which is bcd.com. But this Accepted Domain can not receive mail from outside. I have configure MX record, Accepted Domain and also mail point. but the problem is that mail cannot receive from outside
domain. i have also several time modify the receive connector but abc.com work but bcd.com not work
Please suggest.
Error:
firewall.abc.com rejected your message to the following email addresses:
[email protected] ([email protected])
firewall.abc.com gave this error:
<[email protected]>... Relaying denied
Your message wasn't delivered due to a permission or security issue. The address may only accept email from certain senders or another restriction may be preventing delivery. For more tips to resolve this issue see
DSN code 5.7.1 in Exchange Online. If the problem continues contact your help desk.

Have you checked the SMTP protocol log on the Exchange server? Do you see the 5xx status code in the log when a message is sent to the @bcd.com domain?
If you see the 5xx status code for that domain, check the "Accepted domains" and verify that you didn't make any typos in the domain name. If it looks okay then stop and start the transport service on the Exchange servers and retest.
If you don't see the 5xx status message for that domain you should check the machine firewall.bcd.com and verify that it's configured to accept e-mail for the @bcd.com domain. I'm guessing that the firewall.bcd.com machine is acting as a SMTP proxy and not
as a SMTP relay. However, if there are SMTP log files on that machine you should check them and see which IP address is returning the 5xx status message.
--- Rich Matheisen MCSE&I, Exchange MVP

#554 5.4.4 SMTPSEND.DNS.MxLoopback; DNS records for this domain are configured in a loop ##

Hi,
This is my first post here.
My exchange server of late is facing a peculiar problem. I get the error message that I have posted below when sending mails to any outside domain. However when I restart the server the mails can be resend to the address without any issue. After a certain
time again the issue pops up upon which I am forced to restart the server again. I am running 2007 Exchange on Windows 2003.
Generating server: name.mydomain.com
[email protected]
#554 5.4.4 SMTPSEND.DNS.MxLoopback; DNS records for this domain are configured in a loop ##
[email protected]
#554 5.4.4 SMTPSEND.DNS.MxLoopback; DNS records for this domain are configured in a loop ##
Original message headers:
Received: from name.mydomain.com ([1xx.xxx.xxx.xx5]) by MHDMAILS.mouwasat.com
([1xx.xxx.xxx.xx5]) with mapi; Wed, 19 Oct 2011 08:56:29 +0300
From: <[email protected]>
To: <[email protected]>
CC: "Al Alami,Tareq" <[email protected]>
Date: Wed, 19 Oct 2011 08:56:27 +0300
Subject: RE:
Thread-Topic:
Thread-Index: AcyAQ5tu8z9CvBfdT5+1pcGQkk6x0AIuwczAAAGZjeABQyW5sAADeeJQAAETNDA=
Message-ID: <[email protected]>
References: <[email protected]com>
<[email protected]com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: multipart/related;
            boundary="_004_EEC8FA6B3B286A4E90D709FECDF51AA06C0588CA11namedomain_";
            type="multipart/alternative"
MIME-Version: 1.0

On Sun, 23 Oct 2011 15:05:15 +0000, Jobin Jacob wrote:
>
>
>Even af
>
>ter removing my domain from the send connector I continue to receive the error. I would like to say I do have a firewall, Cyberoam. However, it was the same configuration till now in the firewall. I did try Mx lookup and found the following.
>
>Could there be any other solution to this issue ?
Sure, but it's necessary to ask a lot of questions since none of us
know how your organization is set up.
I see you also have "Use the External DNS Lookup settings on the
transport server" box checked. How have you configured the "External
DNS Lookups" on the HT server's property page? Is there any good
reason why you aren't just using your internal DNS servers? If the
internal DNS servers are configured to resolve (or forward) queries
for "external" domains then there's no reason to use that checkbox. In
most cases checking that box is a mistake.
http://technet.microsoft.com/en-us/library/aa997166(EXCHG.80).aspx
The behavior you describe (it works for a while and then fails;
restarting the server returns it to a working state) sure sounds like
some sort of DNS problem.
Rich Matheisen
MCSE+I, Exchange MVP
--- Rich Matheisen MCSE+I, Exchange MVP

Remove various accepted domains (exchange 2007) from a list file via powershell

hello!
i'm a newbie with powershell and i'm trying to find if is it possible to remove a lot of exchange 2007 accepted domains from a csv file using powershell.
I want to delete accepted domains contained in a csv, it has only domains name and powershell requires the name , that is different from the domain.
example of accepted domain in my organization:
Name DomainName DomainType Default
Domain0001
domain1.com Authoritative False
Domain0002 hello1.com
Authoritative False
I've only a csv with domains name:
domain.csv:
Domain
domain1.com
hello1.com
Deleting an accepted domain via powershell requires the name so I need to extract first the name of , i've tried with this command and it works:
Get-AcceptedDomain | Where{$_.DomainName -eq 'domain1.com'}
This works only for 1 domain, I've a lot of domains to delete so it's inviable
Now, i'm trying to launch this command without success:
import-csv domain.csv | foreach {Get-AcceptedDomain | Where{$_.DomainName -eq '$_.Domain'}}
Probably there is a syntax error, or maybe I just can't do it.
Any help?
Many thanks in advance!!

Don't know what to tell you, then. If I create a test file with that data, the Import-CSV works for me:
Domain
3414257440.domain.com
domain1.domain.com
'@ | set-content c:\testfiles\domain.csv
$DomainNames =
Import-CSV 'c:\testfiles\domain.csv' |
Select -ExpandProperty Domain
$DomainNames
3414257440.domain.com
domain1.domain.com
[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "

Exchange Server 2010 Accepted Domain

Dear,
I have the following environment:
The company bought the company dominioA.com dominioB.com.
Both companies have mail system.
Company A wants to standardize the environment and wants only the mail platform remains in Exchange 2010 mail servers Company A.
to have many users, and also change the MX ip address, the company does not want to do all of one.
As I raise the following:
One Accepted Domain was created with the dominioB.com
An email policy which I think I will do that by creating the accounts you create them in an organizational unit and change them to dominioB.com SMTP.
Send mail testing was made from those accounts to accounts dominioA.com and there were no problems.
Send mail testing was done from the dominioB.com account to an external account and it worked.
Send test mail dominioA.com to DominioB.com and began to bounce post is made. because the mail server is in the domainB, and server Only the domain was created. for this to work one must change the MX, but the company wants to do it gradually.
As I can do ????
Waiting for your comments
Thank You,
Edwin Duran Ospina

Hi,
According to your description, I notice that you have two company, Company A and Company B. Then want to deploy only one Exchange server for mail flow.
If I misunderstand your concern, please do not hesitate to let me know.
If you want to deploy Only one Exchange server SMTP name for two company, I suggest we can deploy forest trust and linked mailbox for Company B’s user.
More details about Deploy Exchange 2010 in an Exchange Resource Forest Topology, for your reference:
https://technet.microsoft.com/en-us/library/aa998031(v=exchg.141).aspx
Best Regards,
Allen Wang

Use Different mailbox or same mailbox if setup two accepted domains in one Exchange Server 2010

Hi,
I want to know if I setup two accepted domain in one Exchange Server 2010, will it have another mailbox or use same mailbox?

Hi,
Based on my knowledge, to add a new name in the accepted domain list is to add a SMTP address suffix for the mailboxes. Thus, it uses the same mailbox if you setup two accepted domain in one Exchange Server 2010.
If you have any question, please feel free to let me know.
Thanks,
Angela Shi
TechNet Community Support

Exchange mailbox creation for child domain

Hi Friend,'
I want to add a child domain,some thing like group.domain.com. We have an exchange 2013 in the network, my requirement is to create 50 users in the child domain and create mail accounts for this child domain users.
My main challenge is to create the CDC and my exchange have the name space domain.com and my CDC is group.domain.com,but i want to add users in mailserver for the CDC users as [email protected]
I know how to add additional suffix in exchange and AD :
http://www.sysguru.in/2014/09/creating-additional-suffixname-space-in.html
Is it possible to use the same scenario for my CDC users also?
Regards

Hi,
In your case, if you want to add additional suffix in your Exchange server in the child domain, you need to add the root domain as an accepted domain.
Here is an article about accepted domain for your reference.
Accepted domains
https://technet.microsoft.com/en-us/library/bb124423(v=exchg.150).aspx
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

SAN for accepted domain

Similar Messages

Maybe you are looking for