How to help secure SMTP client message delivery in Exchange 2003

Considerations

To Create a New SMTP Virtual Server

1. Click Start, point to Programs, point to Microsoft Exchange, and then click System Manager.
2. Expand Administrative Groups (if appropriate), expand AdministrativeGroup (if appropriate), expand Servers, expand ServerName, and then expand Protocols.
3. Right-click SMTP, point to New, and then click SMTP Virtual Server.
4. In the Name box, type the name of the virtual server, and then click Next.
5. Click the IP address that you want to use, and then click Finish.
6. After you create the SMTP virtual server, confirm that the new virtual server is using the correct fully qualified domain name (FQDN). To do so:
   1. Right-click the SMTP virtual server that you created, and then click Properties.
   2. Click the Delivery tab, and then click Advanced.
   3. Confirm that the domain name in the Fully-qualified domain name box matches the name that your users type when they configure their client software to deliver SMTP mail. To confirm that the domain name resolves correctly, click Check DNS.
   4. Click OK, and then click OK.

To Configure IP Address Restrictions

1. Click Start, point to Programs, point to Microsoft Exchange, and then click System Manager.
2. Expand Administrative Groups (if appropriate), expand AdministrativeGroup (if appropriate), expand Servers, expand ServerName, and then expand Protocols.
3. Expand SMTP, right-click Default SMTP Virtual Server, and then click Properties.
4. Click the Access tab, and then click Connection.
5. In the Connection dialog box, click Only the list below.
   
   This indicates that only the IP addresses and the domains that are in the list are permitted to connect to the SMTP virtual server.
6. Click Add, and then do one of the following to add a single computer, a group of computers, or a domain, as appropriate to your situation:
   • To add a single computer, click Single Computer, type the IP address of the e-mail messaging server of your Internet service provider (ISP) in the IP address box, and then click OK.
     
     Alternatively, click DNS Lookup, type a host name, and then click OK.
   • To add a group of computers, click Group of computers, type the subnet address and the subnet mask of the group in the corresponding boxes, and then click OK.
     
     Microsoft recommends this option if your ISP has a tendency to change the IP address of their e-mail messaging server without warning.
   • To add a domain, click Domain, type the domain name that you want in the Name box, and then click OK.
     
     Note that this option requires a DNS reverse lookup on each incoming connection. This requirement may adversely affect the performance of the Exchange server. For more information, see the Troubleshoot section later in this article.

To Configure Access Control

1. Click Start, point to Programs, point to Microsoft Exchange, and then click System Manager.
2. Expand Administrative Groups (if appropriate), expand AdministrativeGroup (if appropriate), expand Servers, expand ServerName, and then expand Protocols.
3. Expand SMTP, right-click the SMTP virtual server, and then click Properties.
4. Click the Access tab, and then click Authentication.
   
   By default, anonymous access is disabled, and basic authentication and integrated Windows authentication are enabled. Configure the SMTP virtual server to use basic authentication with TLS encryption or integrated Windows authentication, and then click OK.

1. Start Outlook Express.
2. On the Tools menu, click Accounts.
3. Click the Mail tab, and then click Properties.
4. Click the Servers tab, click to select the Log on using Secure Password Authentication check box, click OK, and then click Close.
   Note that the user name and the password are encrypted. Message data is not encrypted.

To Configure Encryption

1. Click Start, point to Programs, point to Microsoft Exchange, and then click System Manager.
2. Expand Administrative Groups (if appropriate), expand AdministrativeGroup (if appropriate), expand Servers, expand ServerName, and then expand Protocols.
3. Expand SMTP, right-click the SMTP virtual server, and then click Properties.
4. Click the Access tab, and then click Certificate. Web Server Certificate Wizard starts.
5. Click Next.
6. Follow the instructions on the remaining pages of the wizard to create a new certification or to assign an existing certificate.

1. Click Start, point to Programs, point to Microsoft Exchange, and then click System Manager.
2. Expand Administrative Groups (if appropriate), expand AdministrativeGroup (if appropriate), expand Servers, expand ServerName, and then expand Protocols.
3. Expand SMTP, right-click the SMTP virtual server, and then click Properties.
4. Click the Access tab, and then click Communication.
5. Click to select the Require secure channel check box.
6. If both the Exchange 2003 computer and the clients support 128-bit encryption, click Require 128-bit encryption.
7. Click OK, and then click OK.
8. Stop and then restart the SMTP virtual server.

1. Start Outlook Express.
2. On the Tools menu, click Accounts.
3. Click the Mail tab.
4. Double-click the Exchange Server mail account, and then click the Advanced tab.
5. Under Outgoing Mail (SMTP), click to select the This server requires a secure connection (SSL) check box.
6. Click OK, and then click Close.

To Configure Relaying

1. Click Start, point to Programs, point to Microsoft Exchange, and then click System Manager.
2. Expand Administrative Groups (if appropriate), expand AdministrativeGroup (if appropriate), expand Servers, expand ServerName, and then expand Protocols.
3. Expand SMTP, right-click the SMTP virtual server, and then click Properties.
4. Click the Access tab, and then click Relay.
   
   The default settings permit authenticated clients to relay messages. Typically, these settings are sufficient so that only clients with the correct credentials can relay messages through the SMTP virtual server. You can also restrict relay permissions to single IP addresses, IP address ranges, or DNS suffixes.
5. Click OK.

To Test Whether the SMTP Virtual Server Settings That You Configured Work Correctly

• To confirm that the IP restrictions work correctly, use a POP3 and an IMAP4 client to try to connect to the server from an excluded IP address. If the IP restrictions are configured correctly, you receive a message that notifies you that a connection to the server is declined.
• To verify authentication encryption:
  1. Run Network Monitor on your Exchange 2003 computer, and use the default authentication settings to initiate an SMTP session from the client while you capture the traffic that is coming to the Exchange 2003 computer.
  2. Review the SMTP session and note the packets from the client to the server on port 25 (0019h).
     
     Note that the user's logon name and password are sent in clear text.
  3. Remove support for basic authentication, configure the client to require Secure Password Authentication, initiate another SMTP session from the client, and then capture the traffic in Network Monitor.
     
     The user account and password are now encrypted.
• To test SSL encryption:
  1. Add a certificate, configure the settings so that you require a security-enhanced channel on the SMTP virtual server, and then configure the client to use SSL.
  2. Start a Network Monitor capture, and then initiate an SMTP mail collection session from the client.
  3. Stop the capture, and then examine the packets that were sent.
     
     Note that all client to server packets with a destination of port 25 (0019h) are encrypted.
  Note If you have not enabled encryption on the POP3 or IMAP4 mail collection , you may still see some unencrypted packets from the client that are destined for port 110 (006Eh) or for port 143 (008Fh).
• To test whether relay restrictions work correctly, send mail from an excluded IP address to an external domain. You receive an error message that states that the server was unable to relay for the recipient's address.

Troubleshoot