SMTP Server

Windows Server 2008
SMTP Server

Topic Last Modified: 2007-05-16

Windows Server 2008 SMTP Server uses the Internet-standard Simple Mail Transfer Protocol (SMTP) to transport and deliver messages based on specifications in Request for Comments (RFC) 2821 and RFC 2822. It also includes enhancements that build upon the basic delivery functions of the protocol. There are options available that give you control over the routing and delivery of messages, and that provide secure communications.

For help with specific tasks, see SMTP Server Procedures.

For general background information, see SMTP Server Concepts.

For information about how to monitor performance, see SMTP Server Maintenance.

For problem-solving instructions, see SMTP Server Troubleshooting.

For information about the tabs and properties in the SMTP Server user interface, see Help Reference.


SMTP Server Procedures

SMTP Server Procedures
SMTP Server >

Topic Last Modified: 2007-05-16

This section contains instructions for configuring and operating the Windows Server 2008 SMTP Server feature:

  • Install SMTP Server

  • Use Microsoft Management Console

  • Start, Stop, or Pause an SMTP Virtual Server

  • Start, Stop, or Pause the SMTP Service

  • Configure the SMTP Virtual Server

  • Change the Default Startup Setting

  • Create Additional SMTP Virtual Servers

  • Set Connections

  • Enable Protocol Logging

  • Set Up a Virtual Server for Clustering

  • Set Security Options

  • Manage Messages

  • Deliver the Messages

  • Create or Delete a Domain

  • Configure Local Domains

  • Configure Remote Domains

  • Configure LDAP Server Connections

  • Set Up an ODBC-Compliant Database


Install SMTP Server

Install SMTP Server
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-05-17

The SMTP Server feature is not installed by default on computers that are running Windows Server 2008. You must use Server Manager to install the SMTP Server feature.

Important:
Upon installation of the SMTP Server feature on computers that are running Windows Server 2008, only Anonymous access is enabled on your default SMTP virtual server. For more information, see Requiring Authentication for Incoming Connections.

Procedure

To install SMTP server

  1. Upon installation of Windows Server 2008, Standard operating system and Windows Server 2008, Enterprise operating system, the Initial Configuration Tasks window will appear. You can use this tool to perform this procedure. However, if you have selected the box Do not show this window at logon, you must use the Server Manager to perform this procedure.

    To manually open Server Manager, click Start, point to Administrative Tools and then click Server Manager.

  2. In Server Manager, click Server Manager (server name). In the results pane, locate the Features Summary section, and then click Add features to open the Add Features Wizard.

  3. On the Select Features page, select SMTP Server. If a dialog box appears with the message Add features required for SMTP server?, click Add Required Features. Then click Next.

  4. On the Confirm Installation Options page, click Install. The Installation Progress page shows while the Add Features Wizard installs SMTP Server.

  5. On the Installation Results page, verify that the Installation Succeeded message displays and then click Close.
Note:
The SMTP Server feature is managed by using the Internet Information Services (IIS) 6.0 Manager and configuring the properties of SMTP Virtual Servers.


Use Microsoft Management Console

Use Microsoft Management Console
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-05-16

The administrative tool for the SMTP Server feature is the Internet Information Services (IIS) 6.0 Manager. The IIS 6.0 Manager is implemented as a Microsoft Management Console (MMC). It can perform all operation tasks and requires a local area network (LAN) connection. For instructions about how to start Microsoft Management Console, see Start Microsoft Management Console.

This administration tool is installed by default on the computer running the SMTP Server feature.

To manage the SMTP Server by using Microsoft Management Console from a remote computer, you must be using a computer running Windows Server 2008, add the IIS 6.0 Manager snap-in to MMC, and connect to the computer you want to manage.

Note:
You must grant operators the appropriate permissions to operate the SMTP Server feature. For more information, see Set Security Options.


Start Microsoft Management Console

Start Microsoft Management Console
SMTP Server > SMTP Server Procedures > Use Microsoft Management Console >

Topic Last Modified: 2007-05-16

You have to operate the SMTP Server feature by using the Internet Information Services (IIS) 6.0 Manager snap-in for Microsoft Management Console (MMC) from the computer on which the feature is running.

Important:
The SMTP Server feature is not installed by default on computers that are running Windows Server 2008. For instructions about how to install SMTP Server, see Install SMTP Server.
Note:
You can also use Microsoft Management Console to administer your Simple Mail Transfer Protocol (SMTP) virtual server from a remote computer, provided it's on the same LAN as the SMTP Server. However, the remote computer must be running Windows Server 2008, and you must add the IIS 6.0 Manager snap-in to MMC and connect to the computer you want to manage. If you choose to administer SMTP remotely, make sure your connection to the server that is running SMTP is secure and cannot be compromised.

Procedure

To run IIS 6.0 Manager on the computer on which SMTP Server is running

  1. Click Start, point to Control Panel, point to Administrative Tools, and then click Internet Information Services (IIS) 6.0 Manager.

  2. In the console tree, expand Server name. The virtual server that is provided upon installation of the SMTP Server feature is [SMTP Virtual Server #1].

To view or modify the properties of an SMTP virtual server

  1. Select the SMTP virtual server you want to modify.

  2. On the Action menu, click Properties.

  3. Click the tab that you want to view or modify.

  4. Change any options as needed.

    For more information about tab options, see Accessing Tabs.


Start, Stop, or Pause an SMTP Virtual Server

Start, Stop, or Pause an SMTP Virtual Server
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-05-17

The default SMTP virtual server starts upon installation of the SMTP Server feature. You can pause, stop, and restart it from Microsoft Management Console.

Note:
You can also start, stop, and pause the whole Simple Mail Transfer Protocol (SMTP) service. For instructions, see Start, Stop, or Pause the SMTP Service. However, if you have more than one virtual server, stopping the SMTP service affects all the SMTP virtual servers that are running on your computer. When the SMTP service is stopped, you cannot use Microsoft Management Console to perform administrative functions on any SMTP virtual server.

You can stop and start the SMTP service manually. However, while it's operating, you must be careful when stopping, pausing, or restarting the service to minimize the effect on users.

Important:
Make sure only trusted and qualified administrators in your organization have the necessary permissions to start or stop an SMTP virtual server. For more information, see Set Security Options.

This section describes how to start, stop, and pause SMTP virtual servers by using Microsoft Management Console. It contains the following topics:

  • Starting an SMTP Virtual Server

  • Pausing an SMTP Virtual Server

  • Stopping an SMTP Virtual Server


Starting an SMTP Virtual Server

Starting an SMTP Virtual Server
SMTP Server > SMTP Server Procedures > Start, Stop, or Pause an SMTP Virtual Server >

Topic Last Modified: 2007-01-22

If the default startup setting is Manual, you can use Microsoft Management Console to start a Simple Mail Transfer Protocol (SMTP) virtual server.

Procedure

To start an SMTP virtual server

  1. In Microsoft Management Console, expand the tree structure for the SMTP virtual server.

    For instructions about how to start Microsoft Management Console, see Start Microsoft Management Console.

  2. Click the SMTP virtual server to select it.

  3. On the Action menu, click Start.


Pausing an SMTP Virtual Server

Pausing an SMTP Virtual Server
SMTP Server > SMTP Server Procedures > Start, Stop, or Pause an SMTP Virtual Server >

Topic Last Modified: 2007-01-23

You can pause a Simple Mail Transfer Protocol (SMTP) virtual server for configuration changes and maintenance. Pausing prevents new client connections. However, it enables the virtual server to continue to process existing client connections and delivering queued messages.

Procedure

To pause an SMTP virtual server

  1. In Microsoft Management Console, expand the tree structure for the SMTP virtual server.

    For instructions about how to start Microsoft Management Console, see Start Microsoft Management Console.

  2. Click to select the SMTP virtual server.

  3. On the Action menu, click Pause.


Stopping an SMTP Virtual Server

Stopping an SMTP Virtual Server
SMTP Server > SMTP Server Procedures > Start, Stop, or Pause an SMTP Virtual Server >

Topic Last Modified: 2007-01-23

You can stop a Simple Mail Transfer Protocol (SMTP) virtual server for configuration changes and maintenance.

Procedure

To stop an SMTP virtual server

  1. In Microsoft Management Console, expand the tree structure for the SMTP virtual server.

    For instructions about how to start Microsoft Management Console, see Start Microsoft Management Console.

  2. Click to select the SMTP virtual server.

  3. On the Action menu, click Stop.


Start, Stop, or Pause the SMTP Service

Start, Stop, or Pause the SMTP Service
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-05-16

The Simple Mail Transfer Protocol (SMTP) runs as a service on computers that are running Windows Server 2008. By default, the startup type is set to automatic upon installation of the SMTP Server feature. For instructions about how to install the SMTP Server feature, see Install SMTP Server.

Although there is only one SMTP service on a computer, you can have more than one SMTP virtual server. You can start, stop, or pause each virtual server independently of one another while the SMTP service is running. For more information, see Start, Stop, or Pause an SMTP Virtual Server.

If you have more than one SMTP virtual server, remember that pausing or stopping the whole SMTP service affects all the SMTP virtual servers.

When you start the SMTP service, it accepts new incoming connection requests. When you stop the SMTP service, it does not accept new connections. When you pause the SMTP service, every running SMTP virtual server stops accepting new connections but continues to service existing connections.

Important:
Make sure only trusted and qualified administrators in your organization have the necessary permissions to start or stop the SMTP service. For more information, see Set Security Options.

Procedure

To start, stop, or pause the SMTP service by using Administrative Tools

  1. Click Start, point to Administrative Tools, and then click Services.

  2. In the console tree, select Services (local).

  3. In the results pane, right-click Simple Mail Transfer Protocol (SMTP), and then click Start, Stop, or Pause.
Note:
When you restart the SMTP service, all SMTP virtual servers that had been running when you shut down the service will automatically restart. However, an SMTP virtual server that was already stopped when the service was shut down will remain stopped, even after the SMTP service is restarted.


Configure the SMTP Virtual Server

Configure the SMTP Virtual Server
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-01-22

Simple Mail Transfer Protocol (SMTP) virtual servers have two identifying features:

  • Display name

  • IP address/TCP port combination

Setup assigns a Microsoft Management Console display name for the default SMTP virtual server. You can keep the name [SMTP Virtual Server #1] or change it by using the following steps. You can also select the IP address that will be associated with this SMTP virtual server.

Procedure

To identify an SMTP virtual server

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Rename on the Action menu.

    For instructions about how to start Microsoft Management Console, see Start Microsoft Management Console.

  2. Type a new name for the virtual server name if you want to change it from the default name.

    Note:
    Do not use extended characters when naming your SMTP virtual server.

  3. Select the SMTP virtual server, and then click Properties on the Action menu.

  4. In IP address, select the IP address for this virtual server. The SMTP virtual server can respond to connection requests for all IP addresses configured on the computer. To identify the TCP port for each IP address configured for the virtual server, click Advanced. Port 25 is the SMTP standard TCP port and is recommended. More than one virtual server can use port 25, provided they are associated with different IP addresses.
Note:
When you change an SMTP virtual server's configuration, you may want to use the Pause command. For instructions about how to pause an SMTP virtual server, see Pausing an SMTP Virtual Server. Pausing prevents new client connections but enables the SMTP service to continue to process existing client connections and deliver queued messages.


Change the Default Startup Setting

Change the Default Startup Setting
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-01-22

You can use Administrative Tools to configure the default state of the SMTP service at startup.

Procedure

To change the default startup settings

  1. Click Start, point to Administrative Tools, and then click Services.

  2. In the console tree, select Services (local).

  3. In the results pane, right-click Simple Mail Transfer Protocol (SMTP), and then click Properties.

  4. On the General tab, under Startup type, select Automatic (Delayed Start), Automatic, Manual, or Disabled.


Create Additional SMTP Virtual Servers

Create Additional SMTP Virtual Servers
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-05-16

In most cases, you should only need one Simple Mail Transfer Protocol (SMTP) virtual server. However, if you are hosting multiple domains and want to have more than one default domain, for example, you can create multiple SMTP virtual servers. To an end-user, each SMTP virtual server appears as a separate server that has a unique IP address/TCP port combination.

When you create an SMTP virtual server, you are prompted to enter the path of your root directory. This directory must be local to the computer that the SMTP service is running on.

Note:
Make sure only trusted and qualified administrators in your organization have the necessary permissions to create a new SMTP virtual server. For more information, see Set Security Options.

Procedure

To create a new SMTP virtual server by using Microsoft Management Console

  1. If the SMTP virtual server will be using a new IP address, configure an IP address by selecting Control Panel on the Start menu, and then clicking Network and Sharing Center.

    For more information about Network and Sharing Center, see the Windows Server 2008 documentation.

  2. After the IP address is configured, select an existing SMTP virtual server in Microsoft Management Console. Then, on the Action menu, point to New, and then click Virtual Server. For instructions about how to start Microsoft Management Console, see Start Microsoft Management Console.

  3. Follow the instructions of the New SMTP Virtual Server Wizard. Make sure that you select an IP address/TCP port combination that is not being used by another SMTP virtual server. The recommended TCP port is port 25, which is the SMTP standard TCP port. More than one virtual server can use the same TCP port provided they are configured to have different IP addresses.

  4. If the default startup setting for the SMTP service is set to Automatic, the new SMTP virtual server starts on its own. If it doesn't start, it's because you selected an IP address/TCP port combination that is already being used.

  5. Configure the new SMTP virtual server.


Set Connections

Set Connections
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-01-22

A connection is initiated whenever a message is sent to or received from a remote server.

Important:
Setting connection limits and imposing connection timeouts can make it more difficult for someone to initiate a denial of service attack (DoS) or other malicious attack against your virtual server.
Note:
When configuring incoming connections, you designate the TCP port that the SMTP service uses to receive incoming messages when you identify the Simple Mail Transfer Protocol (SMTP) virtual server. For instructions about how to identify SMTP virtual servers, see Configure the SMTP Virtual Server.

Procedure

To configure incoming connections

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the General tab, select the Limit number of connections to check box and set the following options

Option | Description
Limit number of connections to | When the check box is selected, this option specifies the number of concurrent connections for incoming message delivery. The minimum is one connection. When the check box is not selected, no limit is imposed. The default value is no limit.
Connection time-out (minutes) | This option specifies the time allowed before an inactive connection is closed. The default is 10 minutes.

To configure outbound connections

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Delivery tab, click Outbound connections to open the Outbound Connections dialog box.

  3. Under Outbound Connections, select the check box and set the following options.

Option

Description

Limit number of connections to

When the check box is selected, this option specifies the total number of simultaneous outbound connections to all remote domains that can exist at the same time. The default is 1000 connections. The minimum is 1. The default value is no limit.

This setting can be used to improve system performance together with Limit number of messages per connection to on the Messages tab. For more information and instructions about how to limit the number of messages per connection, see Limiting Number of Messages per Connection.

Time-out (minutes)

This option specifies the time allowed before an inactive connection is closed. The default is 10 minutes.

Limit number of connections per domain to

When the check box is selected, this option limits the number of connections to any single remote domain. The default is 100 connections. This number should be less than or equal to the value for the Limit number of connections to option.

TCP port

This option designates the TCP port that is used for outgoing transmissions. The default is port 25. The outgoing port setting can be the same as that for incoming transmissions, or it can be different.

For an overview of the processes involved in sending messages, see SMTP Server Concepts.


Enable Protocol Logging

Enable Protocol Logging
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-05-08

Protocol logs track the commands that the Simple Mail Transfer Protocol (SMTP) virtual server receives from SMTP clients over the network. You can choose which logging format the SMTP service uses for recording information.

When setting up a log file, remember that the log formats and default file names are the same as those used by other services in Internet Information Services (IIS). If you choose the default names, all transactions for all services are recorded in the same file. You can set up a separate file for each service if you want to maintain separate records. If you set up the file in a different location from the default, be sure it is stored on a local drive, not on a network. Also, because logging is shared with IIS, some of the names are not SMTP specific.

Important:
Auditing server activity with log files is a good way to detect if unauthorized external users are attempting to access your virtual server, or if internal users are trying to access resources they do not have permission to access. For more information about auditing and using Event Viewer, see Events and Errors Message Center.

For detailed information about transaction logging and formats, see Monitoring Message Transactions.

Procedure

To enable logging that uses an ASCII text format

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the General tab, select Enable logging.

  3. In the Active log format drop-down menu, select a log format.

  4. Click Properties, and then on the General tab, specify the New log schedule.

    If you select Hourly, Daily, Weekly, or Monthly, a new log file is created at those intervals.

    If you select Unlimited file size, only a single log file is created.

    If you select When file size reaches, you can specify the maximum size of the log file and a new log file is created when the current log file reaches that size.

  5. On the General tab, under Log file directory, specify the location where the log files will be stored.

  6. If you have selected the World Wide Web Consortium (W3C) Extended Logging format, click the Advanced tab, and then select the extended logging options you want to track.

To enable logging that uses the ODBC format

  1. Set up an ODBC-compliant database. For instructions about how to set up an ODBC-compliant database, see Set Up an ODBC-Compliant Database.

  2. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  3. On the General tab, select Enable logging.

  4. In Active log format, select ODBC Logging.

  5. Click Properties, and then specify the log file size and location.


Set Up a Virtual Server for Clustering

Set Up a Virtual Server for Clustering
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-05-16

Failover Clustering is a feature of Windows Server 2008, Enterprise operating system. For more information about how to install Failover Clustering, see your Windows Server 2008, Enterprise documentation.

A server cluster is a group of independent computer systems, known as nodes, working together as a single system to make sure that mission critical applications and resources remain available to clients. Server clusters provide high availability. High availability in a Simple Mail Transfer Protocol (SMTP) server cluster means that, if one virtual server fails, its work is dispersed to the remaining virtual servers in the cluster. This makes sure that mail service is not interrupted. The other benefit of server clusters is the failover of server resources, which is when a virtual server goes down and another one comes online to assume its role.

In clustering, a node is a system that has a working installation of Windows Server 2008, Enterprise and the Failover Clustering feature. We recommend creating a new virtual server on your node for clustering, instead of reconfiguring your default SMTP virtual server.

For more information about Failover Clustering and server clusters, see Help and Support. That documentation contains detailed information about how to set up and administer server clusters.

Procedure

To set up an SMTP virtual server for clustering

  1. If necessary, change the default startup setting of the SMTP service to Manual. For instructions about how to change the default startup setting, see Change the Default Startup Setting.

  2. Before you create a new virtual server, start Microsoft Management Console, right-click the default SMTP virtual server, and then click Properties. For instructions about how to start Microsoft Management Console, see Start Microsoft Management Console.

  3. On the General tab, click Advanced.

  4. Under IP address, click (All Unassigned) then click Edit.

  5. In the Identification dialog box, change the TCP port number from the default port 25. Any unassigned port will work. It is important to change this port number to avoid conflicts with the new SMTP virtual server you will be creating for clustering. Type the new port number (make sure that it is unique) and then click OK.

  6. Create a new SMTP virtual server. For instructions, see Create Additional SMTP Virtual Servers. After it is created, you must manually start it. Make sure that you use the default TCP port on the new virtual server, port 25.

    Important:
    When you reach the Select Home Directory screen of the New SMTP Virtual Server Wizard, make sure that you type paths to the shared resource that will be used in clustering. Do not type paths to a local hard disk.

  7. Run the IIS Synchronization command to synchronize all IIS information on your node with the other nodes in the server cluster. At a command prompt, open the \Windows\System32\Inetsrv directory on your node and type iissync servername, where servername is another node in the server cluster. For more information about the IIS Synchronization command, see your IIS documentation.

  8. With the server cluster nodes synchronized, you may still have to check the TCP port numbers on your newly created SMTP virtual server and also on the default virtual server. Specifically, when you view your local node from other nodes in the server cluster, make sure that the TCP port settings are identical to how you set them on the local node. On all nodes, the default SMTP virtual server should no longer be pointing to the default port 25, while the new SMTP virtual server should be assigned port 25. Settings must be identical on every node for clustering to work.

  9. Start Failover Cluster Manager. Follow the wizard and associate a resource type to the new SMTP virtual server.

    Note:
    In the Parameters dialog box, make sure that you select your new SMTP virtual server from the drop-down menu, and not the default SMTP virtual server. For more information about Failover Cluster Manager, see Help and Support.


Set Security Options

Set Security Options
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2006-04-04

This section describes the available SMTP virtual server security options:

  • About Security Settings

  • Setting Operator Permissions

  • Requiring Authentication for Incoming Connections

  • Configuring Authentication for Outbound Messages

  • Requiring TLS Encryption

  • Setting IP Access Restrictions to the Server

  • Setting or Removing Relay Restrictions from a Virtual Server


About Security Settings

About Security Settings
SMTP Server > SMTP Server Procedures > Set Security Options >

Topic Last Modified: 2007-01-23

You can decide how secure you want the Simple Mail Transfer Protocol (SMTP) virtual server to be and use the security options on the two security tabs to obtain the level of protection needed. Settings on the tabs apply to all domains on the virtual server.

Security settings

Tab | Settings
Security | This option designates the user accounts that have operator permissions to run the SMTP service. Operators can configure SMTP virtual server properties.
Access | This option contains settings to require authentication and the use of Transport Layer Security (TLS) for all incoming connections. You can also grant access or deny access to specific computers or networks.


Setting Operator Permissions

Setting Operator Permissions
SMTP Server > SMTP Server Procedures > Set Security Options >

Topic Last Modified: 2007-05-16

You can designate which user accounts can have operator permissions for the Simple Mail Transfer Protocol (SMTP) virtual server. After Windows user accounts are set up, you can grant permissions by selecting the account from a list. These permissions can be rescinded by removing the account from the list of virtual server operators.

Procedure

To assign operator permissions

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Security tab, click Add to open the Select Users or Groups dialog box.

  3. Type a Windows user account name in the Enter object names to select (examples) box, click Check Names, and then click OK. The selected account will appear in Operators.

You can also remove operator permissions from the Windows user accounts that are listed in Operators.

To remove operator permissions

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Security tab, click the operator you want to remove.

  3. Click Remove.


Requiring Authentication for Incoming Connections

Requiring Authentication for Incoming Connections
SMTP Server > SMTP Server Procedures > Set Security Options >

Topic Last Modified: 2007-05-16

Three authentication methods are available. You can select one, two, or all three methods. By default, only Anonymous access is enabled. By default, only Anonymous access is enabled to prevent anyone from using your Simple Mail Transfer Protocol (SMTP) virtual server to relay mail. For more information, see Setting or Removing Relay Restrictions from a Virtual Server.

The default mail relay settings on the SMTP virtual server allow only mail from authenticated users to be relayed. Therefore, to allow users in your organization to send mail through the virtual server, users must first authenticate. By selecting one of the methods on the Authentication dialog box, your users will be able to send mail, and at the same time, unauthorized users will not be able to use your virtual server to relay mail.

Authentication option | Description
Anonymous access | An account name or password is not required.
Basic authentication | An account name and a password are sent using clear text. Specify a Windows domain that is appended to the account name for authentication. We strongly recommend that you require Transport Layer Security (TLS) encryption with Basic authentication, to avoid unauthorized detection of user names and passwords.
Integrated Windows Authentication | A Windows account name and password are authenticated using this option.

Procedure

To disable authentication for incoming messages

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Access tab, under Access control, click Authentication to open the Authentication dialog box.

  3. Select Anonymous access, and then click to clear the remaining check boxes for the other options.

To set clear text authentication for incoming messages

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Access tab, under Access control, click Authentication to open the Authentication dialog box.

  3. Select Basic authentication.

  4. In Default domain, type a Windows domain name. This default domain differs from the SMTP virtual server default domain.

To use Integrated Windows Authentication to authenticate incoming messages

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Access tab, under Access control, click Authentication to open the Authentication dialog box.

  3. Select Integrated Windows Authentication.


Configuring Authentication for Outbound Messages

Configuring Authentication for Outbound Messages
SMTP Server > SMTP Server Procedures > Set Security Options >

Topic Last Modified: 2007-01-23

You can configure the Simple Mail Transfer Protocol (SMTP) virtual server to provide the authentication credentials required by a receiving server. Three types of authentication are available: Anonymous access, Basic authentication (clear text), and Integrated Windows authentication. Anonymous access requires no user name or password. With the Basic authentication option, the account name and password that is used to authenticate with the server you're connecting to are transmitted in clear text. The Integrated Windows authentication option requires a Windows account name and password.

The Outbound Security option that is set for the SMTP virtual server can be overridden for a specific remote domain. This enables you to set the virtual server authentication level to handle most of the transmissions, while allowing exceptions for individual addresses. The following table describes common configuration scenarios.

Note:
For information about how to encrypt outgoing messages, see Requiring TLS Encryption.

SMTP transmissions | Authentication option
Messages are commonly sent to multiple addresses. | Disable authentication for the SMTP virtual server. If attempts to deliver messages to an address space fail because of authentication requirements, create a remote domain entry for that address space. Enable authentication for the remote domain at the same level required by the receiving server.
Messages are commonly sent to one address, which requires authentication. | Determine what level of authentication is required to connect. Then enable authentication for the SMTP virtual server using the same level. If you want to send messages to other addresses, set up remote domains and set different authentication options. If you use this option, it is likely that the account name that is used is the one that identifies the computer setup as the smart host.

Procedure

To disable authentication for outgoing messages

  1. On the Delivery tab, click Outbound Security to open the Outbound Security dialog box.

  2. Click Anonymous access.

  3. Clear all other options.

To set Basic authentication for outgoing messages

  1. On the Delivery tab, click Outbound Security to open the Outbound Security dialog box.

  2. Click Basic authentication.

  3. Under User name and Password, type the account name and password that will grant you access to the computer that you are connecting to.
Important:
If Basic authentication is your only authentication method, we strongly recommend that you also require Transport Layer Security (TLS) encryption to avoid unauthorized detection of user names and passwords.

To set Integrated Windows authentication for outgoing messages

  1. On the Delivery tab, click Outbound Security to open the Outbound Security dialog box.

  2. Select Integrated Windows Authentication.

  3. Under Account and Password, type a Windows account name and password that will grant you access to the computer that you are connecting to.


Requiring TLS Encryption

Requiring TLS Encryption
SMTP Server > SMTP Server Procedures > Set Security Options >

Topic Last Modified: 2007-05-16

You can require that all clients use Transport Layer Security (TLS) encryption, a generic security protocol similar to Secure Sockets Layer (SSL), to connect to a Simple Mail Transfer Protocol (SMTP) virtual server. This option helps secure the connection. However, it is not used for authentication.

Important:
When you require Basic authentication on your virtual servers, we strongly recommend that you also use TLS encryption. Without encryption, user names and passwords can be easily intercepted.

To use TLS encryption for the SMTP virtual server, an existing certificate must be present in the trusted certificate store for the Windows Server 2008 computer that is running the SMTP Server feature. The certificate must be issued to the fully qualified domain name (FQDN) for the computer. A certificate that is issued to an IP address or host name cannot be used to provide TLS encryption for SMTP Server communications. By default, the Windows certification authority issues a certificate that uses 128-bit encryption. Clients that connect must also be able to support 128-bit encryption or messages will be returned with a non-delivery report (NDR).

The following procedure enables TLS encryption for all client sessions with the SMTP virtual server and for all sessions with remote servers.

Procedure

To require TLS encryption for all SMTP virtual server communication

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Access tab, under Secure communication, select the Require TLS encryption check box.
Note:
Two additional TLS options are available. To use TLS for all outgoing connections, click Outbound Security on the Delivery tab, and then click TLS encryption. Also, if a server to which you typically connect requires that you use TLS for all incoming connections, you can create a remote domain, click Outbound Security on the remote domain properties General tab, and then select TLS encryption.


Installing a Server Certificate for TLS Encryption

Installing a Server Certificate for TLS Encryption
SMTP Server > SMTP Server Procedures > Set Security Options >

Topic Last Modified: 2007-07-12

This topic explains how to install a server certificate to provide Transport Layer Security (TLS) encryption for the Windows Server 2008 SMTP Server feature. You can require that all clients use TLS encryption to connect to a Simple Mail Transfer Protocol (SMTP) virtual server. TLS is a protocol that provides communications privacy and security between two applications communicating over a network. TLS encrypts communications and enables clients to authenticate servers and, optionally, servers to authenticate clients. TLS is a more secure version of the Secure Sockets Layer (SSL) protocol.

To use TLS encryption for the SMTP virtual server, a certificate must be present in the trusted certificate store for the Windows Server 2008 computer that is running the SMTP Server feature. The certificate must be issued to the fully qualified domain name (FQDN) for the computer. A certificate that is issued to an IP address or host name cannot be used to provide TLS encryption for SMTP Server communications. By default, the Windows certification authority (CA) issues a certificate that uses 128-bit encryption. Clients that connect must also be able to support 128-bit encryption or messages will be returned with a non-delivery report (NDR).

Use one of the following procedures to install a server certificate. If you have an online CA, such as a Windows Server 2008 enterprise CA, the certificate is issued immediately. If you have an offline CA, such as a Windows Server 2008 stand-alone CA or a third-party CA, you must request the certificate and then install the certificate file. You can create a self-signed certificate for SMTP over TLS transactions if the server with which you are communicating does not require CA verification. If CA verification is required, use of a self-signed certificate will cause TLS negotiation to fail.

Procedure

To request and install a server certificate to provide TLS encryption for all SMTP virtual server communication when you have an online CA

  1. Click Start, click Run, type MMC in the Open text field and press Enter. A default Microsoft Management Console (MMC) opens.

  2. Click the File menu, and then click Add/Remove Snap-in.

  3. Select Certificates from the Available snap-ins menu, and then click Add>. On the Certificates snap-in dialog box, select Computer account, and then click Finish. Click OK.

  4. Expand Certificates (Local Computer). Select Personal. Right-click, and then select All Tasks and Request New Certificate. The Certificate Enrollment wizard starts.

  5. On the Before You Begin page, click Next.

  6. On the Request Certificates page, select the box next to Computer. Click the double chevron icon next to Details, and then select Properties.

  7. On the General tab, type a friendly name and description for the certificate.

  8. On the Subject tab, in the Subject name section, use the Type drop-down menu to select Common name. In the Value field, type the FQDN of the server. Click Add>. In the Alternative name section, use the Type drop-down menu to select DNS. In the Value field, type the FQDN of the server. Click Add>.

  9. On the Extensions tab, click the double chevron icon next to Extended Key Usage (application policies). Verify that Server Authentication is a selected option.

  10. On the Certification Authority tab, select the CA that will issue the certificate.

  11. Click OK to save all changes and close Certificate Properties.

  12. Click Enroll on the Request Certificates dialog box. Click Finish to close the Certificate Enrollment wizard.

To request and install a server certificate to provide TLS encryption for all SMTP virtual server communication when you have an offline CA

  1. Click Start, click Administrative Tools, and select Internet Information Services (IIS) Manager to open the IIS 7.0 Manager.

  2. Select the server node.

  3. In the Features pane, select Server Certificates. In the Actions pane, select Open Feature.

  4. In the Actions pane, select Create Certificate Request. The Certificate Request wizard starts.

  5. On the Distinguished Name Properties page, complete all fields, and then click Next.

  6. On the Cryptographic Service Provider Properties page, verify that Microsoft RSA SChannel Cryptographic Provider is selected and that Bit Length is set to 1024. Click Next.

  7. On the File Name page, locate where you want to save the file, and provide a name for the file. The file will have a .txt extension. Click Finish.

  8. Submit the file to your CA. When the administrator has issued the certificate, a file that has the .cer extension is returned to you.

  9. In IIS Manager, select the server node. In the Features pane, select Server Certificates. In the Actions pane, select Complete Certificate Request.

  10. On the Specify Certificate Authority Response page, type the file path and name of the *.cer file or browse to the file location, select the file, and then click Open. Click OK to install the certificate.

To create and install a self-signed server certificate to provide TLS encryption for all SMTP virtual server communication

  1. Click Start, click Run, type cmd in the Open text field, and then press Enter. A command shell window opens.

  2. Type the following command, and then press Enter.

    Copy Code
    makecert -r -pe -n "CN=ServerName" -sky exchange -ss my -sr LocalMachine
    Note:
    For more information about the makecert.exe program, at a command prompt, type makecert -? to view basic options or makecert -! to view extended options.

To verify that the certificate is installed correctly and recognized by the SMTP virtual server

  1. Click Start, click Administrative Tools, and select Internet Information Services (IIS) 6.0 Manager to open the IIS 6.0 Manager.

  2. Select an SMTP virtual server, right-click, and select Properties.

  3. In the SMTP virtual server properties, select the Access tab. If the certificate is installed correctly, in the Secure Communications section, the message A TLS certificate is found with expiration date: MM/DD/YYYY appears and the Require TLS encryption check box is available.


Setting IP Access Restrictions to the Server

Setting IP Access Restrictions to the Server
SMTP Server > SMTP Server Procedures > Set Security Options >

Topic Last Modified: 2007-01-23

You can grant or deny Simple Mail Transfer Protocol (SMTP) virtual server access to specific IP addresses. By default, the SMTP virtual server is accessible to all IP addresses. You can set restrictions by specifying a single IP address, a group of addresses using a subnet mask, or a domain name.

Procedure

To set IP address access restrictions

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Access tab, under Connection control, click Connection to open the Connection dialog box.

  3. Select either Only the list below or All except the list below.

  4. To add to the list of computers, click Add. The Computer dialog box will open.

    To specify a single IP address, click Single computer and enter an IP address.

    To specify a group of addresses, click Group of computers and enter a subnet address and subnet mask.

    To specify a domain, click Domain and enter the domain name. Click OK.

  5. To delete from the list of computers, select a listing and then click Remove.


Setting or Removing Relay Restrictions from a Virtual Server

Setting or Removing Relay Restrictions from a Virtual Server
SMTP Server > SMTP Server Procedures > Set Security Options >

Topic Last Modified: 2007-05-16

By default, SMTP Server blocks computers from relaying unwanted mail through the virtual server. To enable relay access through the Simple Mail Transfer Protocol (SMTP) virtual server, click Relay on the Access tab. By default, all computers are blocked except those that meet the authentication requirements designated in the Authentication dialog box, which you can view by clicking Authentication on the Access tab.

You can also allow messages to be relayed to a specific remote domain. For more information, see Configure Remote Domains. The domain setting overrides the SMTP virtual server setting.

Note:
If your virtual server is on the Internet, you shouldn't allow relaying to avoid propagating unsolicited e-mail.

Procedure

To remove relay restrictions from a virtual server

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Access tab, under Relay restrictions, click Relay. The Relay Restrictions dialog box will open.

  3. Click either Only the list below or All except the list below.

  4. Click Add to open the Computer dialog box and add exceptions to the global access option that you chose in step 3.

You can specify the following options in the Relay Restrictions dialog box.

Option | Description
Only the list below | Only the computers in the list can relay messages through the SMTP virtual server. This is set by default, together with Allow all computers which successfully authenticate to relay, regardless of the list above. Because the list is blank upon a fresh installation of Windows Server 2008, this means only authenticated users can relay mail by default.
All except the list below | All computers can relay messages through the SMTP virtual server, except those in the list.
Add and Remove | This option adds and removes entries to the list of those computers either granted or denied relay access.
Allow all computers which successfully authenticate to relay, regardless of the list above | This option allows computers that meet authentication requirements set in the Authentication dialog box to relay messages to the SMTP virtual server. This is set by default.


Manage Messages

Manage Messages
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-01-23

This section describes how to set connection limits to maximize performance, how to set limits for message size and number of recipients, and how to manage undeliverable messages. It contains the following topics:

  • Limiting Number of Messages per Connection

  • Setting the Message Size Limits

  • Setting the Recipient Limits

  • Storing the NDRs


Limiting Number of Messages per Connection

Limiting Number of Messages per Connection
SMTP Server > SMTP Server Procedures > Manage Messages >

Topic Last Modified: 2007-01-24

You can limit the number of messages sent in a single connection. Limiting the number of messages per connection provides a method to improve system performance by enabling multiple connections to deliver messages to a remote domain. When the set limit is reached, a new connection is automatically opened and the transmission continues until all messages are delivered.

For example, if you typically send many messages to certain remote domains, you could set the Limit number of messages per connection to value to a relatively small number, such as 20. As a result, when sending 100 messages in one session, the SMTP service immediately opens a new connection after the first 20 messages are sent, another after the next 20 messages are sent, and so on. In this case, there could be up to five simultaneous connections delivering queued messages to one destination. Message delivery would be faster, because fewer messages are delivered at the same time, instead of in one long stream over one connection.

To determine a value for the limit, review the Messages Sent/sec performance counter for the SMTP Server object in System Monitor. The Limit number of messages per connection to value should be less than the value indicated by the performance counter. If the counter indicates a value of 30, and you set your maximum connections to 50, no simultaneous connection would be opened because the server wouldn't exceed 30 messages per second. It would work as if the messages were sent in one long stream over one connection. This setting affects outgoing messages only. You can use it to increase your server output speed. However, it does not affect the rate that other servers process incoming messages.

Procedure

To limit the number of messages sent in one connection

  1. In Microsoft Management Console, select the Simple Mail Transfer Protocol (SMTP) virtual server, and then click Properties on the Action menu.

  2. On the Messages tab, select Limit number of messages per connection to, and then type a value in the box. The default is 20.


Setting the Message Size Limits

Setting the Message Size Limits
SMTP Server > SMTP Server Procedures > Manage Messages >

Topic Last Modified: 2007-01-24

The following two message size limit settings exist:

  • Limit message size to This is a preferred message limit for the virtual server. This is what the SMTP service will advertise as the maximum message size that the Simple Mail Transfer Protocol (SMTP) virtual server will accept. If a mail client sends a message that exceeds the limit, the client receives an error. If a remote server supports EHLO, it will detect the advertised maximum message size value when it connects to the SMTP virtual server and won't try to deliver a message that exceeds the limit. Instead it will send a non-delivery report (NDR) to the sender of the message. A remote server that doesn't support EHLO will try to send a message that exceeds the size limit, but will send an NDR to the sender when the message doesn't go through.

  • Limit session size to This is the maximum amount of data accepted during the total connection. This is the sum of all messages sent during the connection (applying to the message body only).

Procedure

To set message size limits

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Messages tab, select Limit message size to (KB), and then type a value (in kilobytes) for the maximum size of a message. The default is 2,048 KB. The minimum value is 1 KB.

  3. On the Messages tab, select Limit session size to (KB), and then type a value to indicate the maximum total size (in kilobytes) of all messages in a specific connection. This number will always be larger than the maximum message size and should be set carefully because the connecting message transfer agent (MTA) is likely to resubmit the message repeatedly. The default size is 10,240 KB. This value should be greater than or equal to the value entered for Limit message size to (KB).


Setting the Recipient Limits

Setting the Recipient Limits
SMTP Server > SMTP Server Procedures > Manage Messages >

Topic Last Modified: 2007-01-24

You can determine the maximum number of recipients for a single message sent in one connection. The default is 100, which is the minimum number that is specified in Request for Comments (RFC) 821. Many clients return messages with a non-delivery report (NDR) after an error message is received. This indicates that the maximum number of recipients has been exceeded. The Simple Mail Transfer Protocol (SMTP) service does not return messages in this instance. It opens a new connection immediately and processes the remaining recipients. For example, if the recipient limit is set to 100 and a message with 105 recipients is received, the first 100 recipients are delivered in one connection. Then a new connection is opened, and the message is processed for the remaining five recipients.

Procedure

To set recipient limits

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Messages tab, in Limit number of recipients per message to, type a number to represent the recipient limit. To impose no limit, click to clear the check box.


Storing the NDRs

Storing the NDRs
SMTP Server > SMTP Server Procedures > Manage Messages >

Topic Last Modified: 2007-05-17

When a message is undeliverable, the Simple Mail Transfer Protocol (SMTP) service returns it to the sender with a non-delivery report (NDR). You can also designate that copies of the NDR be sent to a location of your choice. If the NDR cannot be delivered to the sender, a copy of the message is put in the Badmail directory.

All NDRs follow the same delivery process as other messages, including attempts to resend the message. If the NDR has reached the retry limit and cannot be delivered to the sender, a copy of the message is put in the Badmail directory. Messages put in the Badmail directory cannot be delivered or returned.

Procedure

To set a storage location for NDRs

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Messages tab, in Send copy of Non-Delivery Report to, type the e-mail address of the mailbox that you want to use to store copies of the NDRs. This can be any valid SMTP e-mail address, and is optional. To disable the feature, clear the text box.

  3. In Badmail directory, type the directory you want to use to store undeliverable messages. The default location is root:\inetpub\mailroot\Badmail. Click Browse to select a different folder. You can designate a different directory, provided it is located on the same computer as the SMTP service.


Deliver the Messages

Deliver the Messages
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-01-23

After a connection has been opened and the receiving server has acknowledged that it is ready to receive data, messages can be transmitted for delivery. This section describes the settings that determine how delivery occurs, including route options and the number of times to try delivery. It contains the following topics:

  • About Message Delivery Options

  • Configuring Retry Attempts and Intervals

  • Setting the Maximum Hop Count

  • Setting the Masquerade Domain

  • Setting a Fully Qualified Domain Name

  • Configuring a Smart Host

  • Enabling Reverse DNS Lookup


About Message Delivery Options

About Message Delivery Options
SMTP Server > SMTP Server Procedures > Deliver the Messages >

Topic Last Modified: 2007-02-01

Use the Delivery tab to set all delivery and routing options. Settings can be grouped into the following categories.

Routing Options

The following routing options are available:

  • Smart host This option designates a server through which to route all outgoing messages.

  • Maximum hop count This option determines the maximum number of servers that a message is routed through before it is considered undeliverable.

  • Fully qualified domain name This option clarifies the address to use in mail exchange (MX) records.

Transmission Options

The following transmission options are available:

  • Retry intervals This option determines how many times to resend a message, and at what intervals, before the message is considered undeliverable.

  • Delay notification This option determines how long the message is in retry before a notification is sent to the sender of the message.

  • Expiration timeout This option determines how long the SMTP service will continue to try to deliver a message before the message is considered undeliverable.

Security Options

The following security options are available:

  • Outbound security This option lets you use authentication and Transport Layer Security (TLS) encryption for outgoing messages.

  • Reverse DNS lookup This option verifies that the message actually originated from the computer and the domain listed in the From field.

  • Masquerade domain This option replaces any local domain name used in any Mail From lines in the protocol with a different domain name. This is the name that you want stamped on outgoing messages.


Configuring Retry Attempts and Intervals

Configuring Retry Attempts and Intervals
SMTP Server > SMTP Server Procedures > Deliver the Messages >

Topic Last Modified: 2007-01-24

If a message cannot be delivered on the first try, the Simple Mail Transfer Protocol (SMTP) service sends it again from the Queue directory after a specified time. You can set the interval between delivery attempts. Delivery attempts will continue at the specified intervals until the expiration time-out is reached. After the limit is reached, the message is returned to the sender with a non-delivery report (NDR) and copies of the message and NDR are sent to the location that you designate. The NDR is put in the Queue directory and follows the same delivery process as messages. If the NDR reaches the maximum number of retry attempts, the NDR and message are sent to the Badmail directory.

Procedure

To configure retry attempt and interval settings

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. Click the Delivery tab.

  3. In First retry interval (minutes), type a value for the amount of time to wait before retrying message delivery. The default is 15 minutes.

  4. In Second retry interval (minutes), type a value for the amount of time to wait before retrying message delivery. The default is 30 minutes, which is 30 minutes after the value in First retry interval (minutes).

  5. In Third retry interval (minutes), type a value for the amount of time to wait before retrying message delivery. The default is 60 minutes, which is 60 minutes after the value in Second retry interval (minutes).

  6. In Subsequent retry interval (minutes), type a value for the amount of time to wait between subsequent delivery attempts. The default is 240 minutes.

Delay Notification

To allow for network delays, you can set a delay period to expire before sending a delivery status notification (DSN) to the sender of the message. If the message is not successfully delivered before the delay notification time-out interval has passed, a delay DSN is delivered to the sender. The minimum value is 1 minute, the default is 12 hours, and the maximum value is 9,999 days. Use the drop-down menu next to the value field to select minutes, hours, or days.

Expiration Time-Out

The expiration time-out specifies the maximum length of time that the SMTP service will continue to try to deliver a message. If the message can't be successfully delivered before the expiration time-out interval has passed, a NDR is delivered to the sender. The minimum value is 1 minute. The default is 2 days. The maximum value is 9,999 days. Use the drop-down menu next to the value field to select minutes, hours, or days.


Setting the Maximum Hop Count

Setting the Maximum Hop Count
SMTP Server > SMTP Server Procedures > Deliver the Messages >

Topic Last Modified: 2007-01-24

When a message is being delivered, it may be relayed through several servers before reaching its final destination. You can designate how many servers the message can pass through. This is known as the hop count.

After the maximum hop count is set, the Simple Mail Transfer Protocol (SMTP) virtual server counts the hops listed in the Received lines of the message header. When the number of Received fields exceeds the maximum hop count setting, the message is returned to the sender with a non-delivery report (NDR).

Procedure

To set the maximum hop count

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Delivery tab, click Advanced to open the Advanced Delivery dialog box.

  3. In Maximum hop count, type a value for the number of hops a message can take between the source and destination servers. The default is 15 hops.


Setting the Masquerade Domain

Setting the Masquerade Domain
SMTP Server > SMTP Server Procedures > Deliver the Messages >

Topic Last Modified: 2007-01-24

The masquerade domain replaces any local domain name that is used in the Mail From field of the Simple Mail Transfer Protocol (SMTP) message headers. The replacement occurs on the first hop only.

Procedure

To set the masquerade domain

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Delivery tab, click Advanced to open the Advanced Delivery dialog box.

  3. In Masquerade domain, type the domain name that you want to appear in message headers instead of the actual name of the domain.

Note:
All replies to such messages will be routed through the SMTP virtual server that uses the masquerade domain.


Setting a Fully Qualified Domain Name

Setting a Fully Qualified Domain Name
SMTP Server > SMTP Server Procedures > Deliver the Messages >

Topic Last Modified: 2007-02-01

An e-mail domain must be able to be resolved through Domain Name System (DNS). Two DNS records are used to resolve an e-mail domain. In most cases, a mail exchanger (MX) record is set up to associate an e-mail domain with the fully qualified domain name (FQDN) of one or more Simple Mail Transfer Protocol (SMTP) virtual servers that serve that domain. Each SMTP server referenced in the MX record must have an address (A) record. The A record maps a given FQDN to its IP address.

It's possible to only have an A record set up for an e-mail domain. In this scenario, the A record maps the domain to the IP address or addresses of the SMTP virtual server or servers that serve that domain. Adding an MX record, however, is recommended over using an A record by itself, because an MX record enables an SMTP administrator to specify an ordered list of servers to use for clients sending mail to that e-mail domain. The SMTP service always checks first for an MX record before falling back to an A record. Therefore setting up MX records on your virtual server can improve performance. In some cases the A record is also used for other purposes, such as HTTP, while the MX record is used only for SMTP servers. The MX record enables one server to handle http://example.com. HTTP clients use the A record. Also, the MX record enables another server to handle someone@example.com. SMTP clients use the MX record.

The SMTP service provides two options for specifying an FQDN. You can use the full computer name that is specified on the Computer Name tab of the System Properties in Control Panel, or you can specify a unique FQDN for the SMTP virtual server you are configuring.

At startup, the name designated on the Computer Name tab of the System Properties is automatically used for the FQDN of the SMTP virtual server. If you change the name manually or by joining a domain, the new name is automatically used for the FQDN the next time that the computer is restarted. No action is required to update the FQDN for the virtual server.

To override the automatic use of the computer and domain names on the Computer Name tab, change the FQDN in the Advanced Delivery dialog box, accessed through the Delivery tab. The SMTP service then uses the designated name instead of the one specified on the Computer Name tab.

Procedure

To set up a fully qualified domain name

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Delivery tab, click Advanced to open the Advanced Delivery dialog box.

  3. In Fully qualified domain name, type the FQDN.


Configuring a Smart Host

Configuring a Smart Host
SMTP Server > SMTP Server Procedures > Deliver the Messages >

Topic Last Modified: 2007-01-24

You can route all outgoing messages for remote domains through a smart host instead of using DNS resolution to route them directly to the domain. This enables you to route messages over a connection that may be more direct or less costly than other routes. The smart host resembles the route domain option for remote domains. The difference is that, after you designate smart host, all outgoing messages are routed to that server. With a route domain, only messages for the remote domain are routed to a specific server.

Important:
Make sure that your designated smart host is secure and administered by a trusted authority, especially when forwarding sensitive information.

If you set up a smart host, you can still designate a different route for a remote domain. The route domain setting overrides the smart host setting.

Note:
You can identify the smart host by the fully qualified domain name (FQDN) or an IP address. However, if you change the IP address, you must change the IP address on every virtual server. If you use an IP address, enclose it in brackets ([ ]) to increase system performance. The SMTP service checks first for a server name, and then an IP address. The brackets identify the value as an IP address, so that the DNS lookup is bypassed.

Procedure

To set up a smart host

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Delivery tab, click Advanced to open the Advanced Delivery dialog box.

  3. In Smart host, type the FQDN or the IP address of the smart host server.

  4. If you want the SMTP service to try to deliver remote messages directly before forwarding them to the smart host server, select the Attempt direct delivery before sending to smart host check box. The default is to send all remote messages to the smart host, not to try direct delivery.


Enabling Reverse DNS Lookup

Enabling Reverse DNS Lookup
SMTP Server > SMTP Server Procedures > Deliver the Messages >

Topic Last Modified: 2007-05-08

If you select this option, the Simple Mail Transfer Protocol (SMTP) service will try to verify that the client's IP address matches the host/domain submitted by the client in the EHLO/HELO command. If the reverse DNS lookup is successful, the RECEIVED header remains intact. If the verification is unsuccessful, unverified appears after the IP address in the RECEIVED header of the message. If the reverse DNS lookup fails, RDNS failed appears in the RECEIVED header of the message.

Note:
Because this feature verifies addresses for all incoming messages, its use could affect SMTP service performance. Clear the check box to disable the feature.

Procedure

To enable reverse DNS lookup

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the Delivery tab, click Advanced to open the Advanced Delivery dialog box.

  3. Select the Perform reverse DNS lookup on incoming messages check box.


Create or Delete a Domain

Create or Delete a Domain
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-05-16

Domains in SMTP Server differ from Domain Name System (DNS) domains and Windows domains. Domains configured on Simple Mail Transfer Protocol (SMTP) virtual servers are used for organizing messages for delivery.

This section includes general information about domains and basic procedures. It contains:

  • About Domains

  • Creating a Domain

  • Deleting a Domain

For more information, see the following topics:

  • For information about local domains, see Configure Local Domains.

  • For information about remote domains, see Configure Remote Domains.


About Domains

About Domains
SMTP Server > SMTP Server Procedures > Create or Delete a Domain >

Topic Last Modified: 2007-01-24

The Simple Mail Transfer Protocol (SMTP) virtual server has at least one domain: the default local domain. You can add more domains and configure them to be local or remote. You can delete any domain except the default domain.

Local Domains

A local domain is a Domain Name System (DNS) domain that is serviced by the local SMTP server. Any message that has a local domain name that arrives at an SMTP server must be delivered locally to a Drop directory or returned to the sender with a non-delivery report (NDR). Local domains are also known as service domains or supported domains. E-mail addresses that have local domain names are frequently known as local addresses.

If the domain is local, you can designate it as default or alias. There is one default domain. It is used to stamp message headers that do not have a domain specification. An alias domain is an alias of the default domain. If you add a domain and assign it as the new default, the previous default changes to an alias domain.

Remote Domains

Domains that are not local are known as remote or nonlocal domains, and e-mail addresses that have remote domain names are known as nonlocal addresses. SMTP Server looks up remote domains in DNS.

If you want to set unique delivery requirements for a specific remote domain, you can add a remote domain and configure it accordingly. For example, you can add a remote domain and require that the SMTP service always uses Transport Layer Security (TLS) encryption in sessions with that domain. Or, you can change the routing so that messages sent to one remote domain are routed to another remote domain. Use the Domain Properties dialog box to configure domains.


Creating a Domain

Creating a Domain
SMTP Server > SMTP Server Procedures > Create or Delete a Domain >

Topic Last Modified: 2007-05-16

You can create two types of domains in Windows Server 2008: alias domains and remote domains. Alias domains let you create secondary domains that point to the default domain and use its settings, including the Drop directory. Any message sent to an alias domain is stamped with the default domain name.

Remote domains can be set for domains that you frequently send messages to. For each remote domain, you can set a predetermined delivery route and require that Transport Layer Security (TLS) encryption be used in all sessions with that domain. You can also use a wildcard character in the name so that all inclusive domains for the domain you're creating use the same settings. Use an asterisk (*) as the first character, followed by a period (.). For example, you can use the asterisk as a wildcard character in the following format:

Copy Code
*.example.com

Procedure

To create an alias domain in Microsoft Management Console

  1. In Microsoft Management Console, expand the SMTP virtual server. For instructions about how to start Microsoft Management Console, see Start Microsoft Management Console.

  2. Select Domains.

  3. On the Action menu, point to New, and then click Domain.

  4. Use the New SMTP Domain Wizard to set up a local (alias) domain.

To create a remote domain in Microsoft Management Console

  1. In Microsoft Management Console, expand an SMTP virtual server.

  2. Select Domains.

  3. On the Action menu, point to New, and then click Domain.

  4. Use the New SMTP Domain Wizard to set up a remote domain.

  5. To designate a route domain, set authentication for outgoing messages, or use TLS encryption, select the domain in the results pane, click Properties on the Action menu, and then specify the options.


Deleting a Domain

Deleting a Domain
SMTP Server > SMTP Server Procedures > Create or Delete a Domain >

Topic Last Modified: 2007-01-24

You can delete domains that you have added. You cannot delete the default domain, unless you first add an alias domain and then make that domain the default domain.

Procedure

To delete a domain

  1. In Microsoft Management Console, expand the Simple Mail Transfer Protocol (SMTP) virtual server. For instructions about how to start Microsoft Management Console, see Start Microsoft Management Console.

  2. Click Domains.

  3. In the results pane, select the domain you want to delete.

  4. On the Action menu, click Delete.


Configure Local Domains

Configure Local Domains
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-01-24

This section describes how to set options for existing local domains. It contains the following topics:

  • Designating a Default Domain

  • Configuring an Alias Domain

  • Designating a Drop Directory


Designating a Default Domain

Designating a Default Domain
SMTP Server > SMTP Server Procedures > Configure Local Domains >

Topic Last Modified: 2007-05-16

The default domain is used to stamp messages from addresses that do not have a domain. A Simple Mail Transfer Protocol (SMTP) virtual server can have one default domain. The default domain can't be deleted.

To name a default domain, you can use the primary DNS suffix assigned to your computer. By default, this name is the same as your Active Directory directory service domain. If your computer is not joined to a domain, you can specify a DNS suffix on the DNS tab in the Advanced TCP/IP Settings properties of your LAN connection. This domain name is also used for all other services. Alternatively, you can specify a unique domain to serve as the default for Windows Server 2008 SMTP Server only.

At startup, the DNS suffix configured for the computer is automatically used for the default domain. If you change the DNS suffix on the DNS tab, the new name is used automatically for the default domain the next time that the SMTP service is started. No action is required to update the default domain for the default SMTP virtual server.

To override the automatic use of the network domain, rename the default domain. The SMTP virtual server can then use the designated name instead of the network domain.

Procedure

To rename the default domain

  1. Expand the SMTP virtual server, and then click Domains.

  2. Right-click a domain name in the results pane, and then click Rename.

  3. Enter a new name for the default domain.


Configuring an Alias Domain

Configuring an Alias Domain
SMTP Server > SMTP Server Procedures > Configure Local Domains >

Topic Last Modified: 2007-05-16

You can set up alias domains that use the same settings as the default domain. Messages that are received by Windows Server 2008 SMTP Server for the alias domain are put in the Drop directory designated for the default domain.

Procedure

To configure an alias domain

  1. Expand the Simple Mail Transfer Protocol (SMTP) virtual server, and then right-click Domains.

  2. Point to New, and then click Domain. The New SMTP Domain Wizard starts.

  3. In the New SMTP Domain Wizard, click Alias, and then click Next.

  4. Type a name for the alias domain, and then click Finish.


Designating a Drop Directory

Designating a Drop Directory
SMTP Server > SMTP Server Procedures > Configure Local Domains >

Topic Last Modified: 2007-05-16

For the default domain, you must identify a directory in which to drop all incoming messages. The SMTP virtual server puts messages for alias domains in the Drop directory used for the default domain. You can designate any directory as the Drop directory, provided it is local to the computer for Windows Server 2008 SMTP Server, already exists, and is not already assigned as the Pickup directory. By default, the Drop directory and the Pickup directory are subdirectories of the root directory that is configured for your SMTP content.

Important:
Be sure your Drop directory is in a secure location and can only be accessed by trusted administrators. Otherwise, unauthorized users may be able to access messages in the directory.

Procedure

To designate a Drop directory

  1. In the results pane, right-click the default domain, and then click Properties.

  2. In Drop directory, type the directory used to drop all incoming messages. The default location is root:\Inetpub\Mailroot\Drop. Or click Browse and select the directory. Make sure that you select the Drop directory and not the Pickup directory.


Configure Remote Domains

Configure Remote Domains
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-05-16

You can set unique delivery requirements for a specific remote domain by adding a domain and configuring it accordingly. For example, you can set a predetermined delivery route, set authentication, and require that Transport Layer Security (TLS) encryption be used on all connections to the domain. If the remote domain is not configured specifically, Windows Server 2008 SMTP Server will not perform any of these operations when delivering to this domain. It will, however, complete an ordinary Domain Name System (DNS) lookup.

This section contains the following topics:

  • Setting a Route Domain

  • Enabling TLS Encryption for a Remote Domain

  • Configuring Authentication for a Remote Domain

  • Configuring ATRN for a Remote Domain


Setting a Route Domain

Setting a Route Domain
SMTP Server > SMTP Server Procedures > Configure Remote Domains >

Topic Last Modified: 2007-02-01

You can specify a delivery path that may be faster and less expensive than a direct link. Type the fully qualified domain name (FQDN) or IP address of the server through which you want to route messages for this remote domain. If you enter an IP address, enclose the address in brackets ([ ]) to improve system performance. This setting overrides the smart host setting on the Delivery tab.

Procedure

To designate a route domain

  1. Right-click the SMTP virtual server, point to New, and then click Domain.

  2. Use the New SMTP Domain Wizard to create a remote domain. In the results pane, right-click the new remote domain, and then click Properties.

  3. On the General tab, under Route domain, select Forward all mail to smart host, and then type the FQDN or IP address of the server through which you want to route messages for this remote domain.

    Note:
    You can identify the smart host by FQDN or an IP address. (If you change the IP address, you have to change the IP address on every virtual server). If you use an IP address, enclose it in brackets ([]) to increase system performance. The SMTP service checks first for a server name, and then for an IP address. The brackets identify the value as an IP address, so that the DNS lookup is bypassed.


Enabling TLS Encryption for a Remote Domain

Enabling TLS Encryption for a Remote Domain
SMTP Server > SMTP Server Procedures > Configure Remote Domains >

Topic Last Modified: 2007-05-16

If you don't use Transport Layer Security (TLS) encryption for the Simple Mail Transfer Protocol (SMTP) virtual server, but you select the TLS encryption check box for this remote domain, Windows Server 2008 SMTP Server will use TLS encryption when it connects to the remote domain. Domain configurations always override the virtual server configurations.

Procedure

To enable TLS encryption for a remote domain

  1. Expand the SMTP virtual server, and then click Domains.

  2. In the results pane, click the remote domain you want to change. On the Action menu, click Properties.

  3. On the General tab, click Outbound Security to open the Outbound Security dialog box.

  4. Select Integrated Windows Authentication.

  5. Type the Windows account and password.

  6. Click OK.

  7. Select the TLS encryption check box, and then click OK.
Note:
If the remote domain does not support TLS encryption, all messages will be returned with a non-delivery report (NDR).


Configuring Authentication for a Remote Domain

Configuring Authentication for a Remote Domain
SMTP Server > SMTP Server Procedures > Configure Remote Domains >

Topic Last Modified: 2007-05-16

You can configure a Simple Mail Transfer Protocol (SMTP) virtual server to provide the authentication credentials required by the remote domain. Two types of authentication are available: Basic authentication (clear text) and Integrated Windows authentication. With the Basic authentication option, the account name and password of the server that you're connecting to are transmitted in clear text. The Integrated Windows authentication option requires a Windows account name and password. By default, Anonymous access is configured and no authentication is used.

The selected option overrides the SMTP virtual server authentication setting on the Access tab. The following table describes two configuration scenarios.

SMTP virtual server transmissions | Authentication option
Messages are frequently sent to multiple addresses. | Enable Anonymous access for the SMTP virtual server. If attempts to deliver messages to an address fail because of authentication requirements, add a remote domain for the address. Then enable authentication for the domain at the same level required by the server.
Messages are frequently sent to one address, which requires authentication. | Determine what level of authentication is required to connect. Then enable authentication for the SMTP virtual server using the same level. If you want to send messages to other addresses, set up remote domains and set different authentication options. If you use this option, it is likely that the account name that is used is the one that identifies the computer set up as the smart host.

Procedure

To disable authentication for outgoing messages to a remote domain

  1. Expand the SMTP virtual server, and then click Domains.

  2. In the results pane, click the remote domain you want to change. On the Action menu, click Properties.

  3. On the General tab, click Outbound Security to open the Outbound Security dialog box.

  4. Select Anonymous access, and then click OK.

To set Basic authentication for outgoing messages to a remote domain

  1. Expand the SMTP virtual server, and then click Domains.

  2. In the results pane, click the remote domain you want to change. On the Action menu, click Properties.

  3. On the General tab, click Outbound Security to open the Outbound Security dialog box.

  4. Click Basic authentication.

  5. Type the user name and password of the computer you're connecting to.

  6. Click OK.
Important:
If Basic authentication is your only authentication method, we strongly recommend that you also require Transport Layer Security (TLS) encryption to avoid unauthorized detection of user names and passwords.

To set Integrated Windows authentication for outgoing messages

  1. Expand the SMTP virtual server, and then click Domains.

  2. In the results pane, click the remote domain you want to change. On the Action menu, click Properties.

  3. On the General tab, click Outbound Security to open the Outbound Security dialog box.

  4. Click Integrated Windows Authentication.

  5. Type the Windows account name and password.

  6. Click OK.


Configuring ATRN for a Remote Domain

Configuring ATRN for a Remote Domain
SMTP Server > SMTP Server Procedures > Configure Remote Domains >

Topic Last Modified: 2007-05-16

Windows Server 2008 SMTP Server can hold mail for clients that connect periodically to download messages. In this case, the client issues an ATRN command. The Simple Mail Transfer Protocol (SMTP) service then starts to send messages to the ATRN domain. You can create a remote domain for an address for which your virtual server queues messages and enable ATRN for the domain.

Procedure

To enable ATRN transmissions for a remote domain

  1. Expand the SMTP virtual server, and then click Domains.

  2. In the results pane, click the remote domain you want to change. On the Action menu, click Properties.

  3. Click the Advanced tab, and then select the Queue messages for remote triggered delivery check box.

  4. Click Add or Remove as necessary to select Windows user accounts that will be allowed to use the ATRN command in this domain.


Configure LDAP Server Connections

Configure LDAP Server Connections
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-05-16

Lightweight Directory Access Protocol (LDAP) is an Internet protocol that enables you to access directory information from an LDAP server. If you have been granted permissions to use LDAP, you can browse, read, and search directory listings on the LDAP server.

With the LDAP Routing tab, you can configure Windows Server 2008 SMTP Server so that it will consult an LDAP server to resolve senders and recipients. For example, you can use the Active Directory directory service as an LDAP server, and use Active Directory Users and Computers to create a group mailing list that is automatically expanded on the Simple Mail Transfer Protocol (SMTP) virtual server.

This section describes how to configure an SMTP virtual server as an LDAP client so that you can gain access to directory information on an LDAP server. It contains the following topics:

  • Preliminary Steps to Configuring LDAP Connections

  • Selecting a Schema Type

  • Determining the Authentication Level

  • Setting LDAP Routing Information


Preliminary Steps to Configuring LDAP Connections

Preliminary Steps to Configuring LDAP Connections
SMTP Server > SMTP Server Procedures > Configure LDAP Server Connections >

Topic Last Modified: 2007-01-24

Because some settings on the LDAP Routing tab affect other settings, we recommend that you plan before you configure Lightweight Directory Access Protocol (LDAP).

Procedure

To configure LDAP connections

  1. Determine the schema type to use. For more information, see Selecting a Schema Type.

  2. Determine the level of authentication that is required to bind to the LDAP directory. For more information, see Determining the Authentication Level. If the LDAP server you are connecting to does not require authentication, no account information is necessary.

  3. Determine whether you have to specify a naming context. This may be necessary if the user accounts reside in a subcontainer within the LDAP directory. Specifying a naming context could allow the LDAP directory to return results more quickly and, in some cases, is necessary if there are multiple naming contexts on the LDAP server.


Selecting a Schema Type

Selecting a Schema Type
SMTP Server > SMTP Server Procedures > Configure LDAP Server Connections >

Topic Last Modified: 2007-01-24

The following table shows the schema types that are available from the Schema drop-down menu on the LDAP Routing tab.

Schema type | Description
Active Directory | Select this option to use the Active Directory directory service as the Lightweight Directory Access Protocol (LDAP) server. To manage mailboxes, use Active Directory Users and Computers.
Site Server Membership Directory | Use this option when you have installed Microsoft LDAP Service as part of Microsoft Commercial Internet System 2.0 Mail and you are using it to manage mailboxes.
Exchange LDAP Service | Select this option to use a Microsoft Site Server 3.0 LDAP server to manage mailboxes.


Determining the Authentication Level

Determining the Authentication Level
SMTP Server > SMTP Server Procedures > Configure LDAP Server Connections >

Topic Last Modified: 2007-01-24

The following table shows the four binding types that determine the level of authentication that is used for connections. The option that you select affects other options.

Binding type | Description
Anonymous | No authentication is required. Select this option when the server does not require account and password information.
Plain text | This option enables the transmission of account information and passwords in clear text. When this option is selected, account and password information is required. Be aware that transmitting passwords in clear text is not recommended because information that is not encrypted can be read by unauthorized or malevolent parties.
Windows SSPI | The client and server negotiate to determine which level of authentication is acceptable by both, and use the strongest method that is available. When this option is selected, account and password information is required.
Service account | This option uses the account information of the user under which the SMTP service is running. This is controlled by the settings configured by using Services, under Administrative Tools.


Setting LDAP Routing Information

Setting LDAP Routing Information
SMTP Server > SMTP Server Procedures > Configure LDAP Server Connections >

Topic Last Modified: 2007-01-24

If you enable Lightweight Directory Access Protocol (LDAP) routing for a Simple Mail Transfer Protocol (SMTP) virtual server, you can configure the SMTP virtual server to consult an LDAP directory to resolve senders and recipients.

Procedure

To set LDAP routing information

  1. Select Properties for the SMTP virtual server you want to configure in Microsoft Management Console. For instructions about how to start Microsoft Management Console, see Start Microsoft Management Console.

  2. Click the LDAP Routing tab.

  3. Select the Enable LDAP routing check box.

  4. Set options as described in the following table.

The following table describes the available options.

Option Description

Server

Type the name of the computer that is running the LDAP directory. The field is not applicable when you use the Exchange LDAP Service schema type, because the service will find a nearby server and use it automatically.

Schema

Select a schema type. For more information, see Selecting a Schema Type.

Binding

Select the authentication method to use when binding to the LDAP server. For more information, see Determining the Authentication Level.

Plain text transmits passwords in clear text. To use the strongest authentication method that is available for the SMTP virtual server, select Windows SSPI. For no authentication, use Anonymous, which is the default. The Service account binding type uses the credentials of the account that is trying to bind to the LDAP server.

Domain

Type the domain of the account that you want to use to bind to the LDAP directory. This option applies if you select the Plain text or Windows SSPI binding types.

User name

Type the distinguished name (DN) of the account you want to use to bind to the LDAP directory. For example, cn=user1,ou=users,o=company. This option applies if you select the Plain text or Windows SSPI binding types.

Password

Type the password that is used for logging on to the directory service. This option applies if you select the Plain text or Windows SSPI binding types.

Base

Type the distinguished name of a container in the directory service that you're accessing. This setting specifies where you want the SMTP service to start to search in the LDAP directory. The search will begin in the container and will continue to subcontainers if necessary.


Set Up an ODBC-Compliant Database

Set Up an ODBC-Compliant Database
SMTP Server > SMTP Server Procedures >

Topic Last Modified: 2007-02-01

Procedure

This topic explains how to set up an open database connectivity (ODBC)-compliant database.

To set up an ODBC-compliant database

  1. Create an ODBC-compliant database by using a database program, such as Microsoft Access or Microsoft SQL Server.

  2. Create a table in the database that contains the fields listed in the following table.

    Field name Data type

    ClientHost

    varchar(255)

    Username

    varchar(255)

    LogTime

    datetime

    Service

    varchar(255)

    Machine

    varchar(255)

    ServerIP

    varchar(50)

    ProcessingTime

    integer

    BytesRecvd

    integer

    BytesSent

    integer

    ServiceStatus

    integer

    Win32Status

    integer

    Operation

    varchar(255)

    Target

    varchar(255)

    Parameters

    varchar(255)


SMTP Server Concepts

SMTP Server Concepts
SMTP Server >

Topic Last Modified: 2007-05-17

Mail delivery is a common feature of Internet sites. Internet messages are generally transmitted and delivered using the Simple Mail Transfer Protocol (SMTP). You can use Windows Server 2008 SMTP Server to configure your hardware to deliver messages over an intranet or the Internet.

SMTP Server supports basic SMTP delivery functions. It also provides features that allow you to customize your configuration to accommodate unique delivery and security requirements.

This section provides general background information about SMTP Server and contains the following topics:

  • SMTP Server Overview

  • Key Features

  • Components

  • Process Overview


SMTP Server Overview

SMTP Server Overview
SMTP Server > SMTP Server Concepts >

Topic Last Modified: 2007-05-16

This section provides general information about how to configure Windows Server 2008 SMTP Server and SMTP virtual servers. It contains the following topics:

  • Accessing Tabs

  • Improving System Performance


Accessing Tabs

Accessing Tabs
SMTP Server > SMTP Server Concepts > SMTP Server Overview >

Topic Last Modified: 2007-05-16

You use six tabs to configure the Simple Mail Transfer Protocol (SMTP) virtual servers provided by Windows Server 2008 SMTP Server. The six tabs are described in the following table.

Tab | Description
General | This tab contains settings that determine how the virtual server connects to other SMTP servers to transmit and receive messages. It can also be used to enable logging.
Access | This tab contains settings to require authentication and the use of Transport Layer Security (TLS), which is a type of Secure Sockets Layer (SSL) encryption for all protocols, and for all incoming connections. You can also grant or deny both general and relay access to specific computers or networks.
Messages | This tab configures message limits and determines how to manage undeliverable messages.
Delivery | This tab contains settings that determine how the virtual server delivers messages, including the number of messages sent per connection, how the virtual server routes messages, and retry intervals and expiration time-out for attempts to resend messages.
LDAP Routing | This tab contains settings for Lightweight Directory Access Protocol (LDAP) that allow access to directories that comply with the X.500 directory structure.
Security | This tab designates the user accounts that have operator permissions to configure the SMTP service.

Procedure

To access the SMTP virtual server tabs in Microsoft Management Console

  1. Select the SMTP virtual server that you want to configure. For instructions about how to start Microsoft Management Console, see Start Microsoft Management Console.

  2. On the Action menu, click Properties.

  3. Click the tab that you want to display.


Improving System Performance

Improving System Performance
SMTP Server > SMTP Server Concepts > SMTP Server Overview >

Topic Last Modified: 2007-01-24

Some of the configuration settings for a Simple Mail Transfer Protocol (SMTP) virtual server may affect system performance. To determine how to streamline your system to reduce processing time and optimize delivery connections, see the following topics:

  • Limiting Number of Messages per Connection

  • Configuring a Smart Host

  • Enabling Reverse DNS Lookup


Key Features

Key Features
SMTP Server > SMTP Server Concepts >

Topic Last Modified: 2007-05-16

Windows Server 2008 SMTP Server provides the following features.

Standard Internet Protocol Support

SMTP Server provides full support for Simple Mail Transfer Protocol (SMTP) and is compatible with SMTP mail clients.

Scalability

You can configure SMTP virtual servers to support multiple domains and hundreds of client connections in a single-server configuration.

Easy Administration and Integration with the Windows Server 2008 Operating System

SMTP Server uses Microsoft Management Console for administration. SMTP virtual servers are created and configured by using Internet Information Services (IIS) 6.0 Manager. Administrators can use other Windows Server 2008 administration features including Simple Network Management Protocol (SNMP), event logs, and transaction logs to collect usage statistics, track messages and transactions, or examine usage patterns.

Advanced Security

SMTP Server supports the use of Transport Layer Security (TLS) for encrypting transmissions.

Directed Mail Drop and Pickup

For the default domain, SMTP Server supports placing all incoming messages directly into a Drop directory. This means you can use SMTP Server as a mail receiver for other applications.

In addition to connecting to a TCP port to send messages, applications can also use a Pickup directory. After a message formatted as a text file is copied to the Pickup directory, SMTP Server delivers it.


Components

Components
SMTP Server > SMTP Server Concepts >

Topic Last Modified: 2007-05-16

This section describes the components of Windows Server 2008 SMTP Server, what they do, and how they work together. It contains the following topics:

  • Components and Microsoft Management Console Display Settings

  • Relationship Between the Components

  • Mailroot Directory and Default Directories


Components and Microsoft Management Console Display Settings

Components and Microsoft Management Console Display Settings
SMTP Server > SMTP Server Concepts > Components >

Topic Last Modified: 2007-05-16

All the Internet Information Services (IIS) 6.0 components that are set for your computer are displayed in Microsoft Management Console. Windows Server 2008 SMTP Server is represented as SMTP virtual server nodes in the console tree of Microsoft Management Console. When you select a node, detailed information about the node is displayed in the results pane. The following table provides descriptions of the computer and SMTP virtual server nodes.

Node | Icon | Description
Computer | Computer Icon | This is the main administrative component of IIS. It displays information about each IIS service, including its operational status, the IP address, and the port.
SMTP virtual server | E-mail delivery icon | This is the main administrative component of SMTP Server. It provides access to the tabs for configuring the SMTP virtual server.
Domains | Icon-Two e-mails being delivered | These are organizational components of SMTP virtual servers. The node provides access to the Domain Properties dialog box for creating and configuring domains, and displays information about all domains set up on the virtual server.
Current sessions | Person's head indicating session status | The results pane provides status information about using the SMTP virtual server. The results pane lists the user, source location, and connected time for each active session.


Relationship Between the Components

Relationship Between the Components
SMTP Server > SMTP Server Concepts > Components >

Topic Last Modified: 2007-05-16

You use the SMTP virtual server in Microsoft Management Console to manage Windows Server 2008 SMTP Server. Each virtual server includes a default domain, which is used to stamp messages from addresses that do not have a domain. You cannot delete the default domain. However, you can create an alias domain. All alias domains use the default domain to stamp messages.

For more information about domains, see About Domains.


Mailroot Directory and Default Directories

Mailroot Directory and Default Directories
SMTP Server > SMTP Server Concepts > Components >

Topic Last Modified: 2007-05-16

Setup installs five default subdirectories in the Mailroot directory so that Windows Server 2008 SMTP Server can process messages. Four of the directories are described in the following table. The SortTemp directory, also created during Setup, stores temporary files. The default location of the Mailroot directory is root:\Inetpub\Mailroot. However, you can designate a different location during Setup. The Mailroot subdirectories and their contents are described in the following table.

Important:
Be sure the Mailroot directory and subdirectories can only be accessed by trusted administrators. This security will prevent unauthorized or malevolent parties from accessing messages in those directories.

Directory | Description
Badmail | Stores undeliverable messages that cannot be returned to the sender.
Drop | Receives all incoming messages for all the domains hosted on the computer. You can assign any directory to be the Drop directory, except one that has already been designated as the Pickup directory.
Pickup | Processes outgoing messages that are created as text files and copied to the directory. As soon as a properly formatted Request for Comments (RFC) 2822 message is copied to the Pickup directory, the SMTP service collects it and initiates delivery.
Queue | Holds messages for delivery. If a message cannot be delivered because the connection is busy or down, the message is stored in the queue and sent again at designated intervals.


Process Overview

Process Overview
SMTP Server > SMTP Server Concepts >

Topic Last Modified: 2007-05-16

Windows Server 2008 SMTP Server uses Simple Mail Transfer Protocol (SMTP) to transport and deliver messages according to specifications in Request for Comments (RFC) 2821 and RFC 2822. Messages are transferred between remote mail servers and the Drop directory designated for the default domain. SMTP Server is designed to provide quick turnaround on connections to maximize messages-per-second processing.

This section describes message transmission and delivery by using SMTP Server. It contains the following topics:

  • Processing Messages

  • Local Message Delivery

  • Remote Message Delivery


Processing Messages

Processing Messages
SMTP Server > SMTP Server Concepts > Process Overview >

Topic Last Modified: 2007-01-24

When a message is copied to the Pickup directory or comes in through the designated TCP port, it is put in the Queue directory. The default TCP port is port 25.

If the recipients are local, the message is delivered. If the recipients are not local, the message is processed for remote delivery. Figure 1 shows the message flow proccess.

Important:
Figure 1 omits the recommended presence of one or more firewalls between the Internet and the SMTP Server.
Figure 1 Message flow process

The message flow process


Local Message Delivery

Local Message Delivery
SMTP Server > SMTP Server Concepts > Process Overview >

Topic Last Modified: 2007-01-25

If a message is being delivered to a local recipient, it is moved from the Queue directory to the Drop directory designated for the default domain. After the message is deposited in the Drop directory, the SMTP delivery cycle is finished. You can designate the Drop directory in the Default Domain dialog box. The process flow is shown in Figure 1.

Important:
Figure 1 omits the recommended presence of one or more firewalls between the Internet and the SMTP server.
Figure 1 The local message flow process

The local message flow process


Remote Message Delivery

Remote Message Delivery
SMTP Server > SMTP Server Concepts > Process Overview >

Topic Last Modified: 2007-05-16

The following table describes the processes used by Windows Server 2008 SMTP Server to deliver remote messages. The tabs that you use to configure the options are included in the descriptions.

Process Description

Sort messages and queue for delivery.

Messages remain in the Queue directory. Recipients for each message are sorted by domain so the SMTP service can send them as a group. This enables the SMTP service to optimize connections by delivering multiple messages in one session.

Determine whether the receiving server is ready to receive messages.

The SMTP service tries to connect to the receiving mail server. If the server is not ready, the message remains in the queue and delivery is tried again at designated intervals, up to a maximum number of attempts. These intervals are the retry settings. You set them on the Delivery tab.

Send the message.

After recipients are verified, the message is sent. After the receiving server acknowledges the transmission, SMTP delivery is finished. Consider the following delivery options:

  • If you have enabled Transport Layer Security (TLS) for remote delivery, the SMTP service encrypts all outgoing messages. You can also enable or disable this function for a specific remote domain. You set TLS encryption in the Outbound Security dialog box, which you access by clicking Outbound Security on the Delivery tab.

  • All messages for remote domains can be sent to a smart host, which can then send them to the recipients. You designate the smart host in the Advanced Delivery dialog box, which you access by clicking Advanced on the Delivery tab.

For detailed information about how to use the tabs to configure SMTP virtual servers, see Accessing Tabs.


SMTP Server Maintenance

SMTP Server Maintenance
SMTP Server >

Topic Last Modified: 2007-01-25

This section describes how to monitor processes so that you can analyze your SMTP virtual server configuration and make adjustments for efficient mail processing. It also describes how to pause and stop the SMTP service for maintenance. It contains the following topics:

  • Overview of Monitoring Tools

  • Monitoring System Processes

  • Monitoring SMTP Performance and Configuration

  • Monitoring Message Transactions


Overview of Monitoring Tools

Overview of Monitoring Tools
SMTP Server > SMTP Server Maintenance >

Topic Last Modified: 2007-05-17

Several tools are available for tracking events and monitoring performance. You can use these tools for troubleshooting and determining if system design changes are warranted.

Important:
Auditing server activity with log files is a good way to detect if unauthorized external users are trying to access your Simple Mail Transfer Protocol (SMTP) virtual server, or if internal users are trying to access resources that they do not have permission to access. For more information about how to audit and use Event Viewer, see Help and Support Center.

Windows Server 2008 Event Log

The event log can be used to verify that Windows Server 2008 is performing correctly. The event log tracks informational, warning, and error events, all of which require administrator attention. By default, three logs are available: System, Security, and Application.

Logging of predetermined events begins automatically whenever a computer running Windows Server 2008 is started. For each type of log, you can designate the maximum size, how long to save entries, and whether to automatically overwrite existing events when the log is full or manually clear entries.

Reliability and Performance Monitor

Reliability and Performance Monitor measures the responsiveness of the SMTP service and indicates whether it is performing as expected. You can log actual workload statistics for any system components you want to review. Then you can analyze the data to determine whether configuration adjustments are required to make sure that messages are processed efficiently. To do this, you must enable monitoring and designate what to track.

Protocol Log

The Protocol Log tracks individual SMTP transactions. You must first enable logging, and then determine the frequency and format.


Monitoring System Processes

Monitoring System Processes
SMTP Server > SMTP Server Maintenance >

Topic Last Modified: 2007-05-16

The SMTP service writes information to two Windows Server 2008 event logs: System and Security. Within each log, the SMTP service records informational, warning, and error events.

Monitor these logs closely, and periodically archive them to avoid running out of space. To avoid losing information, clear the logs occasionally so that the SMTP service can continue to write new events.


Monitoring SMTP Performance and Configuration

Monitoring SMTP Performance and Configuration
SMTP Server > SMTP Server Maintenance >

Topic Last Modified: 2007-01-24

This section describes how to use Reliability and Performance Monitor to review system design and performance. It contains the following topics:

  • Reliability and Performance Monitor Overview

  • Monitoring Performance

  • Monitoring System Capacity


Reliability and Performance Monitor Overview

Reliability and Performance Monitor Overview
SMTP Server > SMTP Server Maintenance > Monitoring SMTP Performance and Configuration >

Topic Last Modified: 2007-05-17

After you have configured your system, you can review the design by tracking system performance. You can use Reliability and Performance Monitor to log actual workload statistics for any system objects that you want to review. Then you can analyze the logging data to determine whether configuration adjustments are required to make sure that messages are processed efficiently.

You can customize the logging process to track different types of information. You select the system objects that you want to monitor, and then set counters to track their performance. To fine-tune the tracking and increase administrator response time to events, you can set Reliability and Performance Monitor to generate a warning whenever a counter exceeds or drops below a measurement that you specify. After the data is generated, you can export it to spreadsheets or databases for additional review and analysis.

Monitoring options include the following:

  • You can monitor one computer or several computers at the same time.

  • You can monitor performance in real time in the Chart window, or store data in logs for later use.

For more information about how to use Reliability and Performance Monitor, see your Windows Server 2008 documentation.


Monitoring Performance

Monitoring Performance
SMTP Server > SMTP Server Maintenance > Monitoring SMTP Performance and Configuration >

Topic Last Modified: 2007-05-16

You can monitor message processing and connections for Windows Server 2008 SMTP Server. The following table describes some of the performance counters.

Counter | Normal readings | Description
Local Queue Length | 0 | This counter monitors the number of messages in the local queue. If the number is greater than 0, the server is receiving more messages than it can process. If the number steadily increases, determine what is causing the delay in processing.
Remote Queue Length | 0 | This counter monitors the number of messages in the remote queue. If the number is greater than 0, the server is receiving more messages than it can process. If the number steadily increases, determine what is causing the delay in processing.
Inbound Connections Current | Greater than 0 | This counter monitors the current number of inbound connections. A value of 0 for an extended time can indicate network problems.


Monitoring System Capacity

Monitoring System Capacity
SMTP Server > SMTP Server Maintenance > Monitoring SMTP Performance and Configuration >

Topic Last Modified: 2007-05-16

You can compare actual usage to available resources to determine whether a resource shortage is imminent. To monitor Windows Server 2008 SMTP Server capacity, review both the physical resources and the SMTP service capacity. A physical resource reaches capacity when it is busy 100 percent of the time. A service reaches capacity when requests for service start experiencing delays.

The following table describes the objects to monitor and counters to use.

Object | Counter | Normal readings | Description
Logical Disk | %Disk Time | <70% | This is the percentage of elapsed time that the selected disk drive is busy servicing read or write requests. If readings continuously exceed 70 percent, consider adding another SMTP server.
System | % Total Processor Time | <70% | This is the average percentage of time that all the processors on the system are busy executing non-idle threads. On a multiprocessor system in which all processors are always busy, this is 100 percent. If all processors are 50 percent busy, this is 50 percent. If one-fourth of the processors are 100 percent busy, this is 25 percent. It is the fraction of time that is spent doing useful work. Each processor is assigned an idle thread in the idle process that consumes those unproductive processor cycles not used by any other threads.
Memory | Available Bytes | >10% of total memory | This displays the size of the virtual memory currently on the Zeroed, Free, and Standby lists. Zeroed and Free memory is ready for use, with Zeroed memory cleared to zeros. Standby memory is memory that is removed from a process Working Set but still available. Notice that this is an instantaneous count, not an average over the time interval.


Monitoring Message Transactions

Monitoring Message Transactions
SMTP Server > SMTP Server Maintenance >

Topic Last Modified: 2007-01-24

This section describes how to use transaction logs to track message transmissions. It contains the following topics:

  • Protocol Log Overview

  • Log Formats

  • Log Format Comparison

  • Planning Protocol Logs

  • Enabling Protocol Logging


Protocol Log Overview

Protocol Log Overview
SMTP Server > SMTP Server Maintenance > Monitoring Message Transactions >

Topic Last Modified: 2007-01-24

Protocol logs track the commands that a Simple Mail Transfer Protocol (SMTP) virtual server receives from SMTP clients.

Four formats are available for tracking. Usually they track the same information. The differences among them are depth of detail, type of display, and analytical uses. When you select a format, decide what you want to track, how you want to review the data, and how you want to track transactions from other Internet Information Services (IIS) services. For more information, see Planning Protocol Logs.

The default format is World Wide Web Consortium (W3C) Extended Log File Format. However, you can select a different one. For three of the formats, transactions are written to a text file. You can determine the logging period and maximum size of the file. When the size limit is reached, a new file is created. Back up and remove older files so the system doesn't run out of disk space when it writes to the current transaction log file. There is also a format that enables you to collect data in an ODBC-compliant database.

Note:
The log formats and default file names are the same as those used by other IIS services. Plan what you want to track for all the services, how many files to use, and how to set file size before you select a format for an SMTP virtual server. For more information, see Planning Protocol Logs.


Log Formats

Log Formats
SMTP Server > SMTP Server Maintenance > Monitoring Message Transactions >

Topic Last Modified: 2007-01-24

Four formats are available for transaction logs. For detailed descriptions of the formats and examples of each log, see the following topics:

  • Microsoft IIS Log File Format

  • NCSA Common Log File Format

  • W3C Extended Log File Format

  • ODBC Logging

For a comparison of the log formats, see Log Format Comparison.


Microsoft IIS Log File Format

Microsoft IIS Log File Format
SMTP Server Maintenance > Monitoring Message Transactions > Log Formats >

Topic Last Modified: 2007-05-17

The following describes the Microsoft Internet Information Services (IIS) log file format:

  • Information is written to a comma-delimited ASCII text file.

  • Data is fixed. You cannot customize the log.

  • There are multiple records for a single transmission.

For a complete list of entries, see Microsoft IIS Log File Entries.

The following is an example of the Microsoft IIS log file format:

Copy Code
10.123.12.3,   Nwtraders.com,  8/18/06,  13:17:37,  SMTPSVC1, MAIL01,  10.200.200.1,  90, 42,  0,  250,  0,  MAIL FROM,  -,FROM:<someone@Nwtraders.com>,
10.123.12.3, Nwtraders.com, 8/18/06, 13:17:37, SMTPSVC1, MAIL01, 10.200.200.1, 0, 32, 0, 250, 0, RCPT TO, -, TO:<someone@example.com>,
10.123.12.3, Nwtraders.com, 8/18/06, 13:17:37, SMTPSVC1, MAIL01, 10.200.200.1, 270, 480, 101, 250, 0, DATA, -, 0019E3517201287MAIL01,
10.123.12.3, Nwtraders.com, 8/18/06, 13:17:37, SMTPSVC1, MAIL01, 10.200.200.1, 81, 4, 52, 0, 541, QUIT, -, MAIL01,


Microsoft IIS Log File Entries

Microsoft IIS Log File Entries
Monitoring Message Transactions > Log Formats > Microsoft IIS Log File Format >

Topic Last Modified: 2007-01-30

The following is an example of the Microsoft Internet Information Services (IIS) log file format:

Copy Code
10.123.12.3, Nwtraders.com, 8/18/06, 13:17:37, SMTPSVC1, MAIL01, 10.200.200.1, 90, 42, 0, 250, 0, MAIL FROM, -, FROM:<someone@Nwtraders.com>,

The following table shows the fields in a Microsoft IIS log file entry and an example of each.

Field | Example
Client IP address | 10.123.12.3
Client domain name | Nwtraders.com
Connect date | 8/18/06
Connect time | 13:17:37
IIS service and site number | SMTPSVC1
Server computer name | MAIL01
Server IP address | 10.200.200.1
Processing time in milliseconds | 90
Bytes received | 42
Bytes sent | 0
SMTP protocol reply code | 250
Win32 status or error code | 0
SMTP protocol command | MAIL FROM
Optional field | -
Variable field, dependent on protocol command | FROM:<someone@Nwtraders.com>


NCSA Common Log File Format

NCSA Common Log File Format
SMTP Server Maintenance > Monitoring Message Transactions > Log Formats >

Topic Last Modified: 2007-01-24

The following describes the National Center for Supercomputing Applications (NCSA) common log file format:

  • Information is written to an ASCII text file that uses the NCSA format.

  • Data is fixed. You cannot customize the log.

  • There are multiple records for a single transmission.

For a complete list of entries, see NCSA Common Log Format Entries.

The following is an example of the NCSA common log file format:

Copy Code
10.3.5.1 -  Nwtraders.com  [18/Aug/2006:13:17:37 - 0800] "MAIL FROM -? FROM: someone HTTP/1.0"  250 0
10.3.5.1 - Nwtraders.com[18/Aug/2006:13:17:37 - 0800] "RCPT TO -? TO: someone@example.com HTTP/1.0" 250 0
10.3.5.1 - Nwtraders.com[18/Aug/2006:13:17:37 - 0800] "DATA -?000B72730441764MAIL01 HTTP/1.0" 250 97
10.3.5.1 - Nwtraders.com[18/Aug/2006:13:17:37 - 0800] "QUIT -?someone HTTP/1.0" 0 0


NCSA Common Log Format Entries

NCSA Common Log Format Entries
Monitoring Message Transactions > Log Formats > NCSA Common Log File Format >

Topic Last Modified: 2007-05-17

The following is an example of the National Center for Supercomputing Applications (NCSA) common log file format:

Copy Code
10.3.5.1 - Nwtraders.com [18/Aug/2006:13:17:37 - 0800] "MAIL FROM -? FROM: someone HTTP/1.0" 250 0

The following table shows the fields in an NCSA common log file entry and an example of each.

Field | Example
Client IP address | 10.5.3.1
Client domain name | Nwtraders.com
Connection date and time | [18/Aug/2006:13:17:37 - 0800]
SMTP protocol command and related information | "MAIL FROM -? FROM: someone HTTP/1.0"
SMTP protocol reply code | 250
Bytes sent | 0


W3C Extended Log File Format

W3C Extended Log File Format
SMTP Server Maintenance > Monitoring Message Transactions > Log Formats >

Topic Last Modified: 2007-05-16

The following describes the World Wide Web Consortium (W3C) extended log file format:

  • The W3C extended log file format is the default logging format for the Windows Server 2008 SMTP service and other Internet Information Services (IIS) services.

  • Data is variable. You can select what you want to track.

  • This format is a good option for limiting log size.

  • Information is written to an ASCII text file.

  • This format includes some field options that apply to the Web and FTP services only.

  • There are multiple entries for a single transmission.

The following is an example of the W3C extended log file format:

Copy Code
2006-08-18  13:17:37  10.3.5.1  Nwtraders.com  MAIL01,   10.200.200.1  MAIL FROM  -  -  250  -  357  0  90  -  -  -  -
2006-08-18 13:17:37 10.3.5.1 Nwtraders.com SMTPSVC1 MAIL01 10.200.200.1 RCPT TO - +TO:+<someone@example.com> 250 0 0 33 0 - - -
2006-08-18 13:17:37 10.3.5.1 Nwtraders.com SMTPSVC1 MAIL01 10.200.200.1 DATA - 001b60731171d87 250 0 101 1209 250 0 - - -
2006-08-18 13:17:37 10.3.5.1 Nwtraders.com SMTPSVC1 MAIL01 10.200.200.1 QUIT - Nwtraders.com 0 3215 52 4 291 0 - - -


W3C Extended Log File Entries

W3C Extended Log File Entries
Monitoring Message Transactions > Log Formats > W3C Extended Log File Format >

Topic Last Modified: 2007-05-16

World Wide Web Consortium (W3C) extended log file entries are the default log entries for Windows Server 2008 SMTP Server. Some SMTP log file entries differ from Web and FTP entries. Fields that require text values that do not apply to SMTP Server are represented by a hyphen (-) or a zero (0) in the log file. Fields requiring numeric values are represented by a zero (0) in the log file. In the following table, fields listed in bold text indicate default log file entries.

Field | Log field | Description
Date | date | Connection date
Time | time | Connection time
Client IP Address | c-ip | IP address of the client that accessed the server
Client domain name | cs-username | Client that accessed the server
Service Name | s-sitename | Internet Information Services (IIS) service
Server Name | s-computername | Server on which the log entry was generated
Server IP | s-ip | IP address of the server on which the log entry was generated
Method | cs-method | Simple Mail Transfer Protocol (SMTP) protocol command sent by the client
URI Stem | cs-uri-stem | Not applicable to Microsoft SMTP Service
URI Query | cs-uri-query | Varies for Microsoft SMTP Service; depends on the SMTP protocol command
HTTP Status | sc-status | SMTP protocol reply code
Win32 Status | sc-win32-status | Windows Server 2008 status or error code; 0 indicates success
Bytes Sent | sc-bytes | Bytes sent by the server
Bytes Received | cs-bytes | Bytes received by the server
Time Taken | time-taken | Length of time that the action took in milliseconds
Server Port | s-port | Not applicable to SMTP service
User Agent | cs(User-Agent) | Not applicable to SMTP service
Cookie | cs(Cookie) | Not applicable to SMTP service
Referrer | cs(Referrer) | Not applicable to SMTP service


ODBC Logging

ODBC Logging
SMTP Server Maintenance > Monitoring Message Transactions > Log Formats >

Topic Last Modified: 2007-05-16

The following list describes open database connectivity (ODBC) logging:

  • You must set up an ODBC-compliant database before you use this format.

  • Information is written to a database.

  • There are multiple records for a single transmission.

The following table describes the fields and data types for an ODBC transaction log file.

Field name | Data type | Description
ClientHost | varchar(255) | Client IP address
Username | varchar(255) | Client domain name
LogTime | datetime | Connection date and time
Service | varchar(255) | Internet Information Services (IIS) service
Machine | varchar(255) | Computer name
ServerIP | varchar(50) | Server IP address
ProcessingTime | integer | Processing time in milliseconds
BytesRecvd | integer | Bytes received by server
BytesSent | integer | Bytes sent by server
ServiceStatus | integer | Simple Mail Transfer Protocol (SMTP) protocol reply code
Win32Status | integer | Windows Server 2008 status or error code (A value of 0 indicates success.)
Operation | varchar(255) | SMTP protocol command
Target | varchar(255) | Recipient
Parameters | varchar(255) | No description available


Log Format Comparison

Log Format Comparison
SMTP Server > SMTP Server Maintenance > Monitoring Message Transactions >

Topic Last Modified: 2007-01-30

The following examples show how message transaction data is recorded and displayed in each of the following formats:

  • Microsoft Internet Information Services (IIS) Log File Format

  • National Center for Supercomputing Applications (NCSA) Common Log File Format

  • World Wide Web Consortium (W3C) Extended Log File Format

  • Open database connectivity (ODBC) Logging

Log entries for Simple Mail Transfer Protocol (SMTP) transmissions typically include multiple records. Only one record is shown for each format so that you can clearly see the differences between the formats.

In these examples, Maria Cameron of Nwtraders.com sends an e-mail message to a co-worker on August 18, 2006 at approximately 1:17 pm.

Microsoft IIS Log File Format

Copy Code
10.3.5.1, Nwtraders.com, 8/18/06, 13:17:37, SMTPSVC1, MAIL01, 10.200.200.1, 90, 42, 0, 250, 0, MAIL FROM, -, FROM:<maria@Nwtraders.com>,

NCSA Common Log File Format

Copy Code
10.3.5.1 - Nwtraders.com [18/Aug/2006:13:17:37 - 0800] "MAIL FROM -? FROM: maria HTTP/1.0 250 0

W3C Extended Log File Format

The following example includes default settings only. You can add other settings.

Copy Code
13:17:37 10.3.5.1 MAIL FROM - 250

ODBC Logging

The database includes the following records:

  • Client IP address

  • Client domain name

  • Connection date and time

  • IIS service

  • Server computer name

  • Server IP address

  • Processing time in milliseconds

  • Bytes received by server

  • Bytes sent by server

  • SMTP protocol reply code

  • Win32 status or error code

  • SMTP protocol command

  • Recipient

  • Parameters


Planning Protocol Logs

Planning Protocol Logs
SMTP Server > SMTP Server Maintenance > Monitoring Message Transactions >

Topic Last Modified: 2007-05-16

Review the following information to determine how to use logging for Windows Server 2008 SMTP Server together with other Internet Information Services (IIS) services.

Using the Default Settings

If you use the default settings for all IIS services, transaction logs are generated daily for all services. However, the format differs. The default format for the Web and FTP services is the World Wide Web Consortium (W3C) Extended Log format. Transactions for these services are combined in a file that uses the default options only for this format. The default format for SMTP virtual servers is Microsoft IIS Log File format. Transactions are recorded in a separate file.

Determining Which Format to Use

The default formats for the IIS services differ. If you want to combine records for all services in one file, select the same format for all services. When you select a format, you should also determine how you want to review the data. Three of the four formats write records to ASCII text files, some in space-delimited format and some in comma-delimited format. One of the options writes records to an open database connectivity (ODBC)-compliant database.

Determining How to Set Up the Log File

Consider the items in the following table when you set up transaction log files.

Item | Description
Recording frequency | Determine whether you want the files to log daily, weekly, or monthly.
Log file contents | Determine what to include in a log file. If you use the default file names for all IIS services and use the same format, the transaction records can be merged into one log file. If you use the same format for all services and want a separate file for SMTP virtual servers, designate a separate file for the transaction log.
Log file size | Determine whether you want the file size to be unlimited or set to a specific size.


Enabling Protocol Logging

Enabling Protocol Logging
SMTP Server > SMTP Server Maintenance > Monitoring Message Transactions >

Topic Last Modified: 2007-01-24

Use the General tab to enable protocol logging and to select the format. When you set up the log file, remember that the log formats and default file names are the same as those used by other Internet Information Services (IIS) services. If you select the default names, all transactions for all services are recorded in the same file. You can set up a separate file for each service if you want to maintain separate records.

If you set up the file in a location other than the default, make sure that it is stored on a local drive and not on a network.

Procedure

To enable logging that uses one of the ASCII text formats

  1. In Microsoft Management Console, select the SMTP virtual server, and then click Properties on the Action menu.

  2. On the General tab, select Enable logging.

  3. In the Active log format drop-down menu, select a transaction log format.

  4. Click Properties, and then set the log file size and location.

  5. If you have chosen the World Wide Web Consortium (W3C) Extended Logging format, click the Extended Properties tab, and then click the items that you want to track.

To enable logging that uses the ODBC format

  1. Set up an ODBC-compliant database. For instructions about how to set up an open database connectivity (ODBC)--compliant database, see Set Up an ODBC-Compliant Database.

  2. On the General tab, click Enable logging.

  3. In the Active log format drop-down menu, click ODBC Logging.

  4. Click Properties, and then set the log file size and location.


SMTP Server Troubleshooting

SMTP Server Troubleshooting
SMTP Server >

Topic Last Modified: 2007-01-24

This section provides information and solutions for common operating problems. It contains troubleshooting guidance in the following topics:

  • General Troubleshooting Tips

  • Delivery

  • System

  • Troubleshooting the SMTP Server


General Troubleshooting Tips

General Troubleshooting Tips
SMTP Server > SMTP Server Troubleshooting >

Topic Last Modified: 2007-05-16

You can monitor transmissions and make configuration adjustments to prevent problems. If errors still occur, you can start to troubleshoot in several places.

Regular Reviews

You can set up your system to regularly review transmissions and resolve bottlenecks before they cause problems.

Setting Up a Mailbox to Receive NDRs and Undeliverable Mail

You cannot create mailboxes in Windows Server 2008 SMTP Server. However, you can enter a name and path for an existing mailbox on another server to receive copies of non-delivery reports (NDRs) and undeliverable mail. For example, you can create a mailbox in a client and name it Postmaster. After this option is set, you can review NDRs and undeliverable messages continuously, and correct transmission problems early. Undeliverable messages have a .bad extension.

Using Performance Counters to Gauge Server Load and Identify Bottlenecks

Reliability and Performance Monitor is an excellent tool for tracking process flow information. Review counter data regularly. Therefore, you can adjust configuration settings before they become problems. You can monitor items such as the number of messages in a queue, the number of connections, the average number of retries and recipients, and the number of bytes sent. Reliability and Performance Monitor is a Windows Server 2008 administrative tool. If values steadily increase for a specific counter, investigate the cause so that you can make adjustments.

For more information about how to use Reliability and Performance Monitor, see Monitoring SMTP Performance and Configuration.

Resolving Problems

After an error has occurred, use the following methods to start to troubleshoot the problem.

Reviewing Events in Event Viewer

The System, Application, and Security event logs record events for the SMTP service and other computer processes. You can review events in the logs to determine why an error occurred.

Reviewing .rtr Files in the Queue Directory to Determine Why Messages Are Not Being Delivered

Messages may not be delivered because a remote server is down and the queue is filling up, or all messages may be undeliverable for a variety of reasons. If this occurs, you can open the remote transcript (.rtr) files in the Queue directory to determine why messages were not delivered initially, and why they remain queued to be sent again.


Delivery

Delivery
SMTP Server > SMTP Server Troubleshooting >

Topic Last Modified: 2007-01-24

Delivery problems are typically caused by lack of disk space or incorrect path entries. This section contains the following troubleshooting topics:

  • Messages Aren't Being Delivered to the Drop Directory

  • Messages Aren't Being Delivered to a Specific Remote Domain

  • Remote Messages Aren't Being Routed Through the Smart Host

  • Masquerade Domain Is Set but the From Header Is Unchanged


Messages Aren't Being Delivered to the Drop Directory

Messages Aren't Being Delivered to the Drop Directory
SMTP Server > SMTP Server Troubleshooting > Delivery >

Topic Last Modified: 2007-01-24

Consider the following problems and associated causes and solutions.

Question mark icon-For More Information | The directory or disk is full.
Tool icon-Troubleshooting tip | Empty the Drop directory and clear additional space on the disk, if it is necessary.

Question mark icon-For More Information | The path is invalid.
Tool icon-Troubleshooting tip | Check the Drop directory path in the Domain Properties dialog box for the default domain. The directory must be located on a local drive.


Messages Aren't Being Delivered to a Specific Remote Domain

Messages Aren't Being Delivered to a Specific Remote Domain
SMTP Server > SMTP Server Troubleshooting > Delivery >

Topic Last Modified: 2007-01-24

Consider the following problems and associated causes and solutions.

Question mark icon-For More Information | The route domain path is incorrect. This produces a "Host unreachable" error.
Tool icon-Troubleshooting tip | Check the path on the General tab of the Domain Properties for the remote domain.

Question mark icon-For More Information

The receiving server is down or the message cannot be delivered for a variety of reasons.
Tool icon-Troubleshooting tip

Consider the following possible causes:

  • Check the .rtr files in the Queue directory to determine the cause.

  • Check the retry counters in Reliability and Performance Monitor.

  • Check the receiving server.

Question mark icon-For More Information | The name is incorrect or the address is invalid.
Tool icon-Troubleshooting tip | Check the name and path.

Question mark icon-For More Information

Transport Layer Security (TLS) is required for connections. The key certificate is invalid or the encryption levels don't match.
Tool icon-Troubleshooting tip

Consider the following possible causes:

  • Check whether the use of TLS has been overridden on the Outbound Security settings in the Domain Properties for the remote domain.

  • Check the TLS encryption level that is used by the SMTP service certificate. Make sure that it matches the level required by the receiving server.


Remote Messages Aren't Being Routed Through the Smart Host

Remote Messages Aren't Being Routed Through the Smart Host
SMTP Server > SMTP Server Troubleshooting > Delivery >

Topic Last Modified: 2007-01-24

Consider the following problems and associated causes and solutions.

Question mark icon-For More Information | A route domain is designated for the remote domain and overrides the smart host setting for the SMTP virtual server.
Tool icon-Troubleshooting tip | Change the route domain setting. The route domain cannot be the same as the default domain or any alias domain.

Question mark icon-For More Information | The default domain or an alias domain is designated as the smart host. You cannot use a local domain for the smart host.
Tool icon-Troubleshooting tip | Change the smart host setting in the Advanced Delivery dialog box, accessed by clicking Advanced on the Delivery tab.


Masquerade Domain Is Set but the From Header Is Unchanged

Masquerade Domain Is Set but the From Header Is Unchanged
SMTP Server > SMTP Server Troubleshooting > Delivery >

Topic Last Modified: 2007-01-24

Consider the following problems and associated causes and solutions.

Question mark icon-For More Information | The From header does not show the masquerade domain.
Tool icon-Troubleshooting tip | The From header is only changed for the first hop.


System

System
SMTP Server > SMTP Server Troubleshooting >

Topic Last Modified: 2007-01-24

Unresolved delivery errors can cause system errors. This section contains the following topic:

  • Out of Memory


Out of Memory

Out of Memory
SMTP Server > SMTP Server Troubleshooting > System >

Topic Last Modified: 2007-01-24

Consider the following problems and associated causes and solutions.

Question mark icon-For More Information

Received messages cannot be sent outbound for delivery. This means that they remain in the queue. Each received message is assigned as a mail object in memory. When the message is deposited in the Drop directory, it is removed from memory. If messages cannot be delivered, and you reach the default value of 100,000 objects, the system generates an "Out of Memory" error.
Tool icon-Troubleshooting tip

Check the following performance counters:

  • Local queue length

  • Remote queue length

  • Local retry queue length

  • Remote retry queue length

If the first two counters have values of 0, it indicates that messages are being delivered immediately upon receipt. If the value is larger, it indicates that there is a delay.

If the retry queues have high values, it indicates that messages cannot be delivered. Open the .rtr files to determine what is causing the problem.

For example, if a remote server is down, the remote retry queue length may have a high value and .rtr files in the Queue directory might include the error message "Host not found."


Troubleshooting the SMTP Server

Troubleshooting the SMTP Server
SMTP Server > SMTP Server Troubleshooting >

Topic Last Modified: 2007-05-16

This section describes errors that are common to Windows Server 2008 SMTP Server operations. It contains the following topics:

  • SMTP Service Starts but the SMTP Virtual Server Does Not

  • SMTP Snap-in Is Not Displaying in MMC

  • Queue Directory Contains .bad Files

  • Client Is Unable to Connect


SMTP Service Starts but the SMTP Virtual Server Does Not

SMTP Service Starts but the SMTP Virtual Server Does Not
SMTP Server > SMTP Server Troubleshooting > Troubleshooting the SMTP Server >

Topic Last Modified: 2007-01-24

Consider the following problems and associated causes and solutions.

Question mark icon-For More Information | The SMTP virtual server was stopped in Microsoft Management Console, and the SMTP Service was stopped and started at the command prompt.
Tool icon-Troubleshooting tip | Restart the SMTP virtual server in Microsoft Management Console. For instructions about how to restart the SMTP virtual server in Microsoft Management Console, see Restart the SMTP Virtual Server in MMC.


Restart the SMTP Virtual Server in MMC

Restart the SMTP Virtual Server in MMC
SMTP Server Troubleshooting > Troubleshooting the SMTP Server > SMTP Service Starts but the SMTP Virtual Server Does Not >

Topic Last Modified: 2007-01-24

This topic explains how to restart a Simple Mail Transfer Protocol (SMTP) virtual server in Microsoft Management Console.

Procedure

To restart the SMTP virtual server in Microsoft Management Console

  1. Select the SMTP virtual server.

  2. On the Action menu, click Start.


SMTP Snap-in Is Not Displaying in MMC

SMTP Snap-in Is Not Displaying in MMC
SMTP Server > SMTP Server Troubleshooting > Troubleshooting the SMTP Server >

Topic Last Modified: 2007-05-08

Consider the following problems and associated causes and solutions.

Question mark icon-For More Information | Microsoft Management Console was opened at the command prompt.
Tool icon-Troubleshooting tip | Manually add the Internet Information Services (IIS) 6.0 snap-in with the SMTP Protocol extension. For instructions about how to add the snap-in and extension manually, see Add the SMTP Snap-in Manually.


Add the SMTP Snap-in Manually

Add the SMTP Snap-in Manually
SMTP Server Troubleshooting > Troubleshooting the SMTP Server > SMTP Snap-in Is Not Displaying in MMC >

Topic Last Modified: 2007-01-24

Procedure

This topic explains how to add the SMTP snap-in manually.

To add the SMTP snap-in manually

  1. On the Console menu, click Add/Remove Snap-in.

  2. In the Available snap-ins box, select Internet Information Services (IIS) 6.0.

  3. Click Add.

  4. From the Selected snap-ins list, select Internet Information Services (IIS) 6.0.

  5. Click Edit Extensions.

  6. Select SMTP Protocol. Click OK.

  7. Click OK to close the Add or Remove Snap-ins dialog box.


Queue Directory Contains .bad Files

Queue Directory Contains .bad Files
SMTP Server > SMTP Server Troubleshooting > Troubleshooting the SMTP Server >

Topic Last Modified: 2007-01-24

Consider the following problems and associated causes and solutions.

Question mark icon-For More Information | The Badmail directory is full, and .bad files remain in the Queue directory.
Tool icon-Troubleshooting tip | Clear messages from the Badmail directory.


Client Is Unable to Connect

Client Is Unable to Connect
SMTP Server > SMTP Server Troubleshooting > Troubleshooting the SMTP Server >

Topic Last Modified: 2007-01-24

Consider the following problems and associated causes and solutions.

Question mark icon-For More Information | A client is denied access.
Tool icon-Troubleshooting tip | Check the computer access permissions on the Security tab.


Help Reference

Help Reference
SMTP Server >

Topic Last Modified: 2007-01-29

The following sections provide information about the tabs and properties of the SMTP virtual server user interface:

  • General Tab

  • Access Tab

  • Messages Tab

  • Delivery Tab

  • LDAP Routing Tab

  • Security Tab

  • Local Domain Properties

  • Remote Domain Properties


General Tab

General Tab
SMTP Server > Help Reference >

Topic Last Modified: 2007-02-13

Use the General tab to identify the IP address that is used by the SMTP virtual server, configure multiple identities for the SMTP virtual server, set the connection limit and time-out, and to enable logging. By default, the SMTP virtual server can respond to connection requests for all IP addresses configured on the computer. The following options are available on the General tab.

Fully-qualified domain name

This read-only property shows the fully-qualified domain name (FQDN) that is assigned to this SMTP virtual server. To modify the FQDN, select the Delivery tab and then click Advanced.

IP address

By default, the SMTP virtual server can respond to connection requests for all IP addresses that are configured on the computer. To assign a specific IP address for the SMTP virtual server, use the drop-down menu to select an IP address.

Advanced

Select this option to assign multiple IP addresses for this SMTP virtual server or to assign a TCP port that differs from the default SMTP port 25.

Limit number of connections to

Select this check box to limit the maximum number of concurrent incoming connections for this SMTP virtual server and then type a value. The minimum is one connection. When the check box is not selected, no limit is imposed. Note that setting connection limits can make it more difficult for someone to initiate a denial of service (DoS) or other malicious attack against your virtual server.

Connection time-out (minutes)

This setting determines how long an individual incoming connection can remain in an inactive state before the connection times out and ends. By default, this value is set to 10 minutes.

Enable logging

You can use logging to track commands the SMTP virtual server receives from SMTP clients over the network. Auditing server activity with log files is a good way to detect if unauthorized external users are trying to access your virtual server, or if internal users are trying to access resources that they do not have permission to access. Select the check box to enable logging and then configure the following options:

  • Active Log Format Use the drop-down menu to select one of the logging formats:

    • Microsoft Internet Information Services (IIS) Log File Format This log file is recorded by using a fixed ASCII format.

    • W3C Extended Log File Format This log file format is the default option. Information is recorded in an ASCII form and can be customized. This lets you select the items that you want to track.

    • National Center for Supercomputing Applications (NCSA) Common Log File Format This log file is recorded by using a fixed ASCII format.

    • ODBC Logging This format uses an open database connectivity (ODBC)-compliant database to store logged data for a fixed set of data fields.

  • Properties Use the Logging Properties dialog box to configure the new log schedule and log file directory.


General Tab > Advanced

General Tab > Advanced
SMTP Server > Help Reference > General Tab >

Topic Last Modified: 2007-01-30

Use the Advanced dialog box to add, remove, or edit IP addresses and TCP port numbers for this SMTP virtual server. Each virtual server is identified by its IP address and TCP port combination. You can define additional IP addresses to which this SMTP virtual server responds. Users can connect to the SMTP virtual server by using any of the defined IP addresses. The following options in the Advanced dialog box let you configure multiple identities for this virtual server or modify the existing identities.

Option | Description
Address | This option lists each IP address that are assigned to this SMTP virtual server, and the TCP port of each address. Users can connect to the SMTP virtual server by using any of the IP addresses listed.
Add | Click Add to open the Identification dialog box, add a new IP address and select a TCP port number for it on this SMTP virtual server.
Edit | Select an entry from the Address table and then select Edit to open the Identification dialog and modify the IP address, TCP port number, or both.
Remove | Select an entry from the Address table and then click Remove to delete the IP address that you have selected.


Identification

Identification
Help Reference > General Tab > General Tab > Advanced >

Topic Last Modified: 2007-05-16

Use the Identification dialog box to specify the IP address and TCP port that are used to communicate with this SMTP virtual server. Port 25 is the Simple Mail Transfer Protocol (SMTP) standard TCP port. Port 25 is recommended. More than one virtual server can use port 25 if the virtual servers are associated with different IP addresses. You can configure the following options on the Identification dialog box.

IP address

Use this option to specify the IP addresses that are used by this SMTP virtual server. You can select [All Unassigned] to specify that the SMTP virtual server can use all IP addresses that are not specifically assigned to other SMTP virtual servers. To select a specific IP address, use the drop-down box and select an IP address that is defined on the computer that is running Windows Server 2008 SMTP Server from the list. To configure multiple IP addresses for a server, click Start, select Control Panel, and then click Network and Sharing Center.

TCP port

Type the TCP port number that is used to connect to this SMTP virtual server. The default port is port 25. SMTP virtual servers are identified by their IP address/TCP port number combination. Therefore, more than one SMTP virtual server can use the same TCP port if the virtual servers are assigned different IP addresses. If you assign an IP/TCP port number combination to an SMTP virtual server that is already being used, that virtual server will not start. For a new port number to take effect, you must restart your computer.


Access Tab

Access Tab
SMTP Server > Help Reference >

Topic Last Modified: 2007-05-16

Use the Access tab to configure client access to the SMTP virtual server and to establish transmission security. The following options are available on the Access tab:

Access control

Use this option to select one or more authentication methods for the SMTP virtual server. Click Authentication to open the Authentication dialog box and configure the authentication options.

Secure communication

Select the Require TLS encryption check box to enable Transport Layer Security (TLS) encryption for all sessions with this SMTP virtual server. This option is only available after a server certificate has been issued to the fully qualified domain name (FQDN) for the computer and the certificate is installed.

Connection control

Use this option to restrict access to the SMTP virtual server. By default, the SMTP virtual server can be accessed from all IP addresses. However, you can grant access or deny access to specific IP addresses, while granting or denying access for a larger group. You can do this by specifying a single IP address, a group of addresses by using a subnet mask, or a domain name. To view access restriction options, click Connection.

Relay restrictions

Windows Server 2008 SMTP Server blocks computers from relaying unwanted mail through the virtual server. By default, all computers are blocked from relay access except those that have met authentication requirements. You can enable relay access to the virtual server for specific computers, for a group of addresses by using a subnet mask, or for a domain. Click Relay to view relay restriction options. Be aware that the SMTP virtual server relay access setting can be overridden for a specific remote domain.


Access Tab > Authentication

Access Tab > Authentication
SMTP Server > Help Reference > Access Tab >

Topic Last Modified: 2007-05-16

Use the Authentication dialog box to select one or more authentication methods for the SMTP virtual server. Windows Server 2008 SMTP Server verifies the user's identity and grants access to the SMTP virtual server by using the configured authentication mechanism. By default, only anonymous access is enabled. The following options are available.

Allow anonymous

Select this option to allow anonymous access to this SMTP virtual server. No user name or password is required.

Basic authentication

Select this option to enable Basic (clear-text) authentication. Basic authentication transmits the password in clear text. We recommend that you require Transport Layer Security (TLS) encryption with Basic authentication to prevent compromise of user names and passwords during transmission. If you select Basic authentication, you can also configure the following options:

  • Requires TLS encryption Select this check box to require encryption of credentials by using TLS.

  • Default domain Type the domain name that is used as the default domain for Basic authentication. The domain name is appended to the account name.

Integrated Windows Authentication

Select this option to enable the client and the server to negotiate the Windows Security Support Provider Interface. This security feature makes it possible for businesses to provide secure logon services for their customers. Integrated Windows Authentication uses a cryptographic technique for authenticating users and does not require the user to transmit actual passwords over the network.

Note: Using Integrated Windows Authentication requires a mail client that supports this authentication method.


Access Tab > Connection

Access Tab > Connection
SMTP Server > Help Reference > Access Tab >

Topic Last Modified: 2007-01-30

Use the options on the Connection dialog box to limit access to the SMTP virtual server by client IP address or domain name. You can grant access to all computers and then make exceptions to this rule by denying access to specific computers. Also, if you deny access to all computers, you still can grant access to specific computers. The following options are available on the Connection dialog box.

Select which computers may access this virtual server

Select from one of the following options to control access to this virtual server:

  • Only the list below Select this option to deny access to all connections except the specific IP addresses and domains that you add to the Computers table.

  • All except the list below Select this option to grant access to all connections except the specific IP addresses and domains that you add to the Computers table.

Computers

The Computers table lists the IP addresses and domains to which you have specifically granted or denied access. The Access column displays either Granted or Denied next to an IP address or domain. The IP Address (Mask) / Domain Name column identifies the IP addresses and domain names to which you have specifically granted or denied access. Select from the following options to modify the Computers table:

  • Add Click Add to open the Computer dialog box and grant access or deny access to a specific IP address, IP address range, or domain name.

  • Remove Select an entry in the Computers table and then click Remove to delete that IP address or domain entry.


Access Tab > Relay Restrictions

Access Tab > Relay Restrictions
SMTP Server > Help Reference > Access Tab >

Topic Last Modified: 2007-05-08

Use the options in the Relay Restrictions dialog box to limit relay access through the SMTP virtual server by client IP address or domain name. By default, only authenticated users can relay mail. You can grant relay access to all computers and then make exceptions to this rule by denying relay access to specific computers. Also, if you deny relay access to all computers, you still can grant relay access to specific computers.

Be aware that if your virtual server is on the Internet, we do not recommend relaying. If you enable relaying, the virtual server might be used to propagate unsolicited commercial e-mail or spam.

The following options are available.

Select which computer may relay through this virtual server

Select from one of the following options to control relay access through this virtual server:

  • Only the list below Select this option to deny relay access to all connections except the specific IP addresses and domains that you add to the Computers table.

  • All except the list below Select this option to grant relay access to all connections except the specific IP addresses and domains that you add to the Computers table.

Computers

The Computers table lists the IP addresses and domains to which you have specifically granted or denied relay access. The Access column displays either Granted or Denied next to an IP address or domain. The IP Address (Mask) / Domain Name column identifies the IP addresses and domain names to which you have specifically granted or denied access.

Select from the following options to modify the Computers table:

  • Add Click Add to open the Computer dialog box and grant access or deny access to a specific IP address, IP address range, or domain name.

  • Remove Select an entry in the Computers table and then click Remove to delete that IP address or domain entry.

Allow all computers which successfully authenticate to relay, regardless of the list above

This check box is selected by default. This option enables relaying by anyone who is granted access to this virtual server by using their authentication credentials.


Computer Dialog Box

Computer Dialog Box
SMTP Server > Help Reference > Access Tab >

Topic Last Modified: 2007-02-01

Use the Computer dialog box to specify the IP addresses or domain names to which you want to grant access or deny access. You can specify a single computer, a group of computers, or a domain name. The following options are available on the Computer dialog box.

Single computer

Select this option to grant access or deny access to a single computer. If you select this setting, the following options are available:

  • IP address Enter the IP address of a single computer.

  • DNS Lookup If you know the name of the computer that you want to add to the list, but do not know the IP address, click DNS Lookup. In the dialog box that appears, enter the DNS name of the computer, and then click OK. The DNS server will resolve the computer name to an IP address and SMTP Server will automatically populate the IP address field.

Group of computers

Select this option to grant access or deny access to all the computers within a specific subnet. If you select this option, you must enter the following information:

  • Subnet address Enter the base IP address for a group of computers.

  • Subnet mask Enter the subnet mask that specifies the range of IP addresses to which the base IP address extends.

For example, if you enter a subnet address of 192.168.1.0 and a subnet mask of 255.255.255.0, all computers that have an IP address in the range of 192.168.1.1 to 192.168.1.254 are included in the group of computers.

Domain

Select this option to grant access or deny access to all the computers in a specific domain. If you select this option, you must enter the domain name in the Name field. Restricting access by domain name requires a reverse DNS lookup on each connection. The additional processing overhead can affect overall SMTP Server performance.


Messages Tab

Messages Tab
SMTP Server > Help Reference >

Topic Last Modified: 2007-05-16

Use the options on the Messages tab to configure the limits that are applied to the message size, session size, number of messages per connection, and number of recipients per message. You can also configure the options that control how undeliverable messages are handled. The following options are available on the Messages tab.

Limit message size to (KB)

Select this check box to limit the message size for this SMTP virtual server. To allow unlimited maximum message size, clear the check box. The SMTP virtual server will advertise this value as the maximum message size that this SMTP virtual server accepts. If a mail client sends a message that exceeds the limit, the client will receive an error. If a remote server supports EHLO, it will detect the advertised Maximum message size value when it connects to the SMTP virtual server and won't even try to deliver a message that exceeds the limit. Instead, the message is returned to the sender with a non-delivery report (NDR). A remote server that doesn't support EHLO will try to send a message that exceeds the size limit and send an NDR to the sender when the message doesn't go through.

For the Limit message size to (KB), type a value for the maximum size of a message, in kilobytes (KB). The default value is 2,048 KB. The minimum value is 1 KB.

Limit session size to (KB)

Select this check box to limit the maximum amount of data that is accepted during the total connection. This value is the sum of all messages sent during the connection (applying to the message body only).

Type a value larger than the Limit message size to (KB) value. Set this maximum carefully, because the connecting message transfer agent (MTA) is likely to resubmit the message repeatedly. The default size is 10,240 KB. The minimum value is equal to the value that is assigned to the individual message size limit.

Limit number of messages per connection to

Select this check box to limit the number of messages sent in a single connection. The default value is 20. This feature also provides a method to increase system performance by using multiple connections to deliver messages to a remote domain. Therefore, after the set limit is reached, a new connection is automatically opened and the transmission continues until all messages are delivered. To disable this feature and have no limit, clear the check box.

Limit number of recipients per message to

Select this check box to limit the maximum number of recipients for a single message. The default value is 100, which is the minimum required number that is specified in Request for Comments (RFC) 2821. To disable this feature and have no limit, clear the check box.

After an error message is received, some clients return messages together with an NDR that indicates that the maximum number of recipients has been exceeded. A server that is running Windows Server 2008 SMTP Server does not return messages together with an NDR in this instance. It opens a new connection immediately and processes the remaining recipients. For example, if the recipient limit is set to 100 and a message that has 105 recipients is being transmitted, the first 100 recipients are delivered in one connection after receipt of the error message. Then a new connection is opened and the message is processed for the remaining five recipients.

Send copy of Non-Delivery Report to

When a message is undeliverable, it is returned to the sender with an NDR. You can designate that copies of the NDR are sent to a specific SMTP mailbox. Type an e-mail address for the mailbox.

Badmail directory

All NDRs follow the same delivery process as other messages, including attempts to resend the message. If the NDR has reached the retry limit and cannot be delivered to the sender, a copy of the message is put in the Badmail directory. Messages that are put in the Badmail directory cannot be delivered or returned. Check the directory regularly and reconcile the messages, because a full directory may adversely affect SMTP Server performance. By default, the Badmail directory is a subfolder of your Mailroot directory. To select an alternative location for the Badmail directory, click Browse.


Delivery Tab

Delivery Tab
SMTP Server > Help Reference >

Topic Last Modified: 2007-02-01

After a connection has been opened and the receiving server has acknowledged that it is ready to receive data, messages can be transmitted for delivery. Use the Delivery tab of the SMTP virtual server Properties page to set all delivery and routing options. This includes setting retry intervals for delivering messages, limiting the number of hops to servers during delivery, and identifying a masquerade domain name to display in the From line instead of the sender's original domain name.

The following options are available on the Delivery tab.

Outbound

Use the Outbound settings to configure how the SMTP virtual server handles delayed mail. The following settings are available:

  • First retry interval (minutes) This setting determines how long the SMTP virtual server waits before it tries to resend a message when the first delivery attempt is unsuccessful. The default value for this setting is 15 minutes.

  • Second retry interval (minutes) This setting determines how long the SMTP virtual server waits before it tries to resend a message after the first retry is unsuccessful. The default value for this setting is 30 minutes.

  • Third retry interval (minutes) This setting determines how long the SMTP virtual server waits before it tries to resend a message after the second retry is unsuccessful. The default value for this setting is 60 minutes.

  • Subsequent retry interval (minutes) This setting determines how long the SMTP virtual server waits between attempts to resend a message after the third retry is unsuccessful. Delivery attempts continue until the expiration time out is reached. The default value for this setting is 240 minutes.

  • Delay notification This setting determines how long the SMTP virtual server waits after the original mail delivery attempt before it notifies the sender of the message that delivery is delayed. The default value of this setting is 12 hours.

  • Expiration timeout This setting determines how long the SMTP virtual server continues to try to deliver a message before it expires the message and sends a non-delivery report (NDR) to the sender of the message.

Local

Use the Local settings to configure the delay notification and expiration time out for local mail delivery. The following options are available:

  • Delay notification This setting determines how long the SMTP virtual server waits after the original mail delivery attempt before it notifies the sender of the message that delivery is delayed. The default value of this setting is 12 hours. The minimum value is 1 minute and the maximum value is 9999 days. Use the drop-down menus to set the value to minutes, hours, or days.

  • Expiration timeout This setting determines how long the SMTP virtual server continues to try to deliver a message before it expires the message and sends an NDR to the sender of the message. The default value of this setting is 2 days. The minimum value is 1 minute and the maximum value is 9999 days. Use the drop-down menus to set the value to minutes, hours, or days.

Outbound Security

Click Outbound Security to access the Outbound Security dialog box and configure the authentication method and credentials that are used by the SMTP virtual server to authenticate to a receiving server. You can also require that sessions are encrypted by using Transport Layer Security (TLS). These options can be set for all outgoing messages on the Outbound Security dialog box, and overridden for a specific remote domain on the Domain Properties tab. This lets you set the SMTP virtual server authentication and encryption level to handle most of the transmissions, while you allow exceptions for individual addresses.

Outbound Connections

Click Outbound Connections to configure the SMTP virtual server to limit the number of concurrent outbound connections.

Advanced

Click Advanced to configure the advanced delivery options, including the maximum hop count, masquerade domain, fully qualified domain name (FQDN), and smart host identity.


Outbound Security

Outbound Security
SMTP Server > Help Reference > Delivery Tab >

Topic Last Modified: 2007-05-16

Use the Outbound Security dialog box to configure the authentication method and credentials that are used by the SMTP virtual server to authenticate to a receiving server. Three types of authentication are available:

  • Anonymous

  • Basic (clear text)

  • Integrated Windows Authentication

Anonymous access, the default option, requires no authentication. You can also require that outbound sessions are encrypted by using Transport Layer Security (TLS). These options can be set for all outgoing messages on the Outbound Security dialog box, and overridden for a specific remote domain on the Domain Properties tab. This enables you to set the SMTP virtual server authentication and encryption level to handle most of the transmissions, while allowing exceptions for individual addresses.

The following options are available on the Outbound Security dialog box.

Anonymous access

Use this option to disable authentication for outbound transmissions. This is the default option.

Basic authentication

With the Basic authentication option, the account name and password of the server that you're connecting to are transmitted in clear text. This setting should match the receiving server's incoming authentication requirements. A user name and password are required for this option. Click Browse to select a user.

Integrated Windows Authentication

Select this option to use Integrated Windows Authentication for authentication. This setting should match the receiving server's incoming authentication requirements. A Windows user account name and password are required for this option. Click Browse to select an account.

TLS encryption

Select this check box to require that all outgoing messages are encrypted by using TLS.


Delivery Tab > Outbound Connections

Delivery Tab > Outbound Connections
SMTP Server > Help Reference > Delivery Tab >

Topic Last Modified: 2007-05-16

Use the Outbound Connections dialog box to configure settings for outgoing connections on this SMTP virtual server. The following options are available on the Outbound Connections dialog box:

Limit number of connections to

Configure this setting to specify the maximum number of concurrent outbound connections to all remote domains. The check box is selected by default, and the default limit is 1,000. The minimum value is 1 connection. Clear the check box to impose no limit on the number of outbound connections.

Time-out (minutes)

Configure this setting to specify how long the SMTP virtual server will wait for a response from the receiving server before the connection times out. By default, the value of this setting is 10 minutes. If a connection is inactive for the designated number of minutes, Windows Server 2008 SMTP Server closes it.

Limit number of connections per domain to

Configure this setting to specify the maximum number of concurrent outbound connections to any single remote domain. By default, the value is set to 100. The value should be less than or equal to the value that you set for Limit number of connections to.

TCP port

Configure this setting to specify the TCP port that is used for outbound SMTP transmissions. The default setting is port 25. This is the SMTP standard TCP port.


Delivery Tab > Advanced Delivery

Delivery Tab > Advanced Delivery
SMTP Server > Help Reference > Delivery Tab >

Topic Last Modified: 2007-05-16

Use the Advanced Delivery dialog box to set routing options on your SMTP virtual server. The following options are available on the Advanced Delivery dialog box:

Maximum hop count

When a message is delivered, it may be routed to several servers before it reaches its final destination. You can designate how many servers that the message can pass through. This is known as the hop count.

After the hop count is set, the SMTP virtual server counts hops that are listed in the Received header lines of the message header. When the number of Received fields exceeds the maximum hop count setting, the message is returned to the sender with a non-delivery report (NDR). By default, the maximum hop count value is 15.

Masquerade domain

The masquerade domain name replaces the local domain name listing in Mail From lines in the SMTP protocol.

Fully qualified domain name

Two records can be used to identify and verify a computer in a TCP/IP network:

  • The mail exchanger (MX) record

  • The address (A) record

The MX record identifies the host and domain name associated with the SMTP virtual server. The MX record uses the fully qualified domain name (FQDN) for the domain name. The A record identifies the IP address for the computer. When both records are used, name resolution occurs faster.

For Windows Server 2008 SMTP Server to process MX records, an FQDN must be designated. An FQDN is used by Domain Name System (DNS) to identify the host server for a domain. The syntax is host.domain. For example, CompanyA.com may have several host servers, with one named Server01. The FQDN for the server would be Server01.CompanyA.com.

By default, the FQDN is the name of the default domain configured for the SMTP virtual server. To override the automatic use of the default domain, change the FQDN on the Delivery tab.

Smart host

You can route all outgoing messages for remote domains through a smart host instead of sending them directly to the domain. This lets you route messages over a connection that may be more direct or less costly than other routes. The smart host is similar to the route domain option for remote domains. The difference is that after a smart host is designated, all outgoing messages are routed to that server. With a route domain, only messages for the remote domain are routed to a specific server.

Make sure that the designated smart host is optimized for security and administered by a trusted authority, especially when forwarding sensitive information.

If you set up a smart host, you can still designate a different route for a remote domain. The route domain setting overrides the smart host setting.

Type an FQDN or an IP address to identify the smart host. If you use an IP address, enclose it in brackets [ ] to enhance system performance. The SMTP service checks first for a name then an IP address. The brackets identify the value as an IP address. Therefore, the DNS lookup is bypassed.

Attempt direct delivery before sending to smart host

Select this option to try to deliver remote messages directly before forwarding them to the smart host server. The default is to send all remote messages to the smart host, not to try direct delivery.

Perform reverse DNS lookup on incoming messages

If you select this option, SMTP Server will try to verify that the client's IP address matches the host/domain submitted by the client in the EHLO/HELO command. If the reverse DNS lookup is successful, the RECEIVED header will remain intact. If the verification is unsuccessful, "unverified" appears after the IP address in the RECEIVED header of the message. If the DNS lookup fails, "RDNS failed" will appear in the RECEIVED header of the message. Because this feature verifies addresses for all incoming messages, its use could affect SMTP Server performance.


LDAP Routing Tab

LDAP Routing Tab
SMTP Server > Help Reference >

Topic Last Modified: 2007-05-08

You can configure an SMTP virtual server so that it will consult a Lightweight Directory Access Protocol (LDAP) server to resolve senders and recipients. For example, you can use the Active Directory directory service as an LDAP server, and use the Active Directory Users and Computers administrative tool to create a group mailing list that is automatically expanded on the SMTP virtual server.

Use the LDAP Routing tab to enable LDAP routing and to specify the identity and properties of the directory services server that is used for this SMTP virtual server. The directory services store information about mail clients and their mailboxes. The SMTP virtual server uses LDAP to communicate with the directory services.

To start LDAP routing, select the Enable LDAP routing check box. Then you can configure the following fields:

Server

Type the name of the computer running the LDAP directory. The field is not applicable when you use the Microsoft LDAP Service schema type, because the service will find a nearby server and use it automatically.

Schema

Select the type of directory service being used. The available types are as follows:

  • Active Directory Select this option to use Active Directory as the LDAP server. To manage mailboxes, use Active Directory Users and Computers in Microsoft Management Console.

  • Site Server Membership Directory Select this option to use a Microsoft Site Server 3.0 LDAP server to manage mailboxes.

  • Exchange LDAP Service Use this option when you have installed Exchange LDAP Service as part of Microsoft Commercial Internet System 2.0 Mail and you are using it to manage mailboxes.

Binding

Select the binding type. The binding type specifies how the SMTP virtual server is authenticated by the directory service. The available types are as follows:

  • Anonymous No user name or password is sent to the directory service. This is the default for SMTP virtual servers you create.

  • Plain text The User name and Password values are sent to the directory service as unencrypted clear text. This is the default for the default SMTP virtual server.

  • Windows SSPI The client and server negotiate to determine which level of authentication is acceptable by both, and use the strongest method that is available. When this option is selected, user name and password information is required.

  • Service account Uses the credentials of the account under which the SMTP service is running. This is controlled by Services, under Administrative Tools.

Domain

Type the domain of the account you want to use to bind to the LDAP directory. This option applies if you select the Plain text or Windows SSPI binding types.

User name

Type the distinguished name (DN) of the account you want to use to bind to the LDAP directory. For example: cn=user1,ou=users,o=company.

This option applies if you select the Plain text or Windows SSPI binding types.

Password

Type the password that is used for logging on to the directory service. This option applies if you select the Plain text or Windows SSPI binding types.

Base

Type the distinguished name of a container in the directory service you're accessing. This setting specifies where you want the SMTP service to start to search in the LDAP directory. The search will begin in the specified container and will continue to search subcontainers if it is necessary.

A Base may be necessary if the user accounts reside in a subcontainer within the LDAP directory. Specifying a Base could allow the LDAP directory to return results more quickly and, in some cases, is necessary if there are multiple naming contexts on the LDAP server.


Security Tab

Security Tab
SMTP Server > Help Reference >

Topic Last Modified: 2007-05-16

Use the Security tab to designate the client accounts that have operator permissions for the SMTP virtual server. Any existing Windows account can be granted access permissions for the virtual server by selecting the account from a list. These permissions can be rescinded by removing the account from the list of SMTP virtual server operators.

The following options are available on the Security tab.

Operators

The display lists the user accounts and security groups that have operator permissions for the SMTP virtual server. Operators can access and configure the SMTP virtual server.

Add

Click Add to open the Select Users or Groups window, where you can select Windows user accounts or security groups to be operators of this SMTP virtual server.

Remove

Select an entry in the Operators list and then click Remove to delete the account from the list of SMTP virtual server operators.


Local Domain Properties

Local Domain Properties
SMTP Server > Help Reference >

Topic Last Modified: 2007-05-16

A local domain is a Domain Name System (DNS) domain that is serviced by the local SMTP virtual server. Any incoming message that has a local domain name must be delivered locally to the Drop directory for the default domain or returned to the sender with a non-delivery report (NDR). Local domains are also known as service domains or supported domains. E-mail addresses that have local domain names are known as local addresses.

A local domain is configured as either the default domain or an alias domain. The default domain name is configured when the SMTP virtual server is created. You create alias domains to provide an alternative identity for the default domain. The default domain is used to stamp message headers that do not have a domain specification. Messages that are received for an alias domain are stamped with the default domain and are put in the Drop directory. You cannot configure the properties of an alias domain. An alias domain uses the configuration of the default local domain.

You can configure the following options on the Properties page of a default local domain.

Drop directory

All incoming local messages are delivered to the Drop directory that is set for the default domain. There are no mailboxes.

Any alias domain you create uses the same Drop directory. You can designate any directory as the Drop directory, provided it is local to the drive for Windows Server 2008 SMTP Server and is not already assigned as the Pickup directory. By default, the Drop directory is a subdirectory of the Mailroot directory. To select another location, click Browse.

Enable drop directory quota

When Enable drop directory quota is selected, SMTP Server limits the size of your Drop directory to 10 times the size that is specified by the Limit message size to (KB) setting on the Messages tab.

Exceeding this quota will generate a 452 4.2.2 Mailbox Full entry in the protocol log.


Remote Domain Properties

Remote Domain Properties
SMTP Server > Help Reference >

Topic Last Modified: 2007-05-16

A remote domain is a domain outside to your organization to which you send e-mail. You can set unique delivery requirements for a specific remote domain by adding a domain and configuring it accordingly. For example, you can set a predetermined delivery route, require authentication, and require that Transport Layer Security (TLS) encryption be used on all connections to the domain. If the remote domain is not configured specifically, Windows Server 2008 SMTP Server will not perform any of these special operations when delivering to this domain. However, it will complete an ordinary DNS lookup.

You can include an asterisk (*) in a remote domain name if it is the first character listed and is followed by a period (.). Using the wildcard indicates that all inclusive domains for the domain that you are creating use the same settings.

For remote domains, you can set the following options on the General tab.

Allow incoming mail to be relayed to this domain

By default, SMTP Server blocks computers from relaying unwanted mail to the remote domain. Select the Allow incoming mail to be relayed to this domain check box to override the relay restriction setting on the Access tab.

Send HELO instead of EHLO

ESMTP defines a method for extending SMTP that enables an SMTP server to inform an SMTP client of the extensions it supports. An SMTP client supporting ESMTP starts an SMTP session by issuing the EHLO command instead of the HELO command. A successful response issues a list of SMTP extensions the server supports. If the server does not support ESMTP, an error is generated. Select the Send HELO instead of EHLO check box to communicate only with HELO when you send to the remote domain.

Outbound security

The authentication and TLS encryption options set on the Delivery tab can be overridden for a specific remote domain. This enables you to set the SMTP virtual server authentication level for most transmissions, while enabling exceptions for individual addresses handled by a particular remote domain. Select Outbound Security to set the authentication level for this remote domain.

Route domain

You can specify one of the following options to control how messages are routed to the remote domain:

  • Use DNS to route to this domain Select this option to use DNS name resolution to locate SMTP servers in the remote domain.

  • Forward all mail to smart host Select this option to specify that messages sent to the remote domain are forwarded to a smart host. The smart host setting for a remote domain overrides the virtual server smart host setting on the Delivery tab. Type the fully qualified domain name or IP address of the server through which you want to route messages for this remote domain.


Remote Domain Properties > Advanced

Remote Domain Properties > Advanced
SMTP Server > Help Reference > Remote Domain Properties >

Topic Last Modified: 2007-05-16

Use the Advanced tab of the Remote Domain properties page to configure advanced message delivery options for a remote domain.

You can configure the following options on the Advanced tab.

Queue messages for remote triggered delivery

Select this check box to enable Windows Server 2008 SMTP Server to hold mail for clients that connect periodically to download messages. In this case, the client issues an ATRN command. The Simple Mail Transfer Protocol (SMTP) service then starts to send messages to the ATRN domain. You can create a remote domain for an address for which your virtual server queues messages and enable ATRN for the domain.

Accounts authorized to use ATRN

This option lists the user accounts and groups that are authorized to use ATRN for this remote domain. Click Add and Remove as necessary to grant or remove ATRN authorization to users.

Add

Click Add to open the Select Users or Groups window. Select the Windows user accounts or groups that are granted ATRN authorization.

Remove

Select an entry in the Accounts authorized to use ATRN list and then click Remove to delete the account from the list.