2

And that, if that domain doesn't have TLS turned on, email-sending fails? I've been looking at setting up SMTP send connectors, but there doesn't seem to be an option to enforce TLS?

2 Answers 2

4

Yes, if you're using Exchange 2007 or 2010 just create a send connector and specify the domain in question as a remote domain.

Then use powershell to enable or disable TLS. Be sure to configure a certificate using Get-ExchangeCertificate and New-ExchangeCertificate. Take note that by default the expiration is in one year.

Next, edit your send connector to use TLS with TLSSendDomainSecureList ...

Here are step-by-step instructions: http://technet.microsoft.com/en-us/library/bb123543.aspx

1
  • 1
    Strangely, Microsoft provides no way to manage this list by adding or removing one domain at a time. If one anticipates multiple "mutual TLS" relationships with clients, vendors, etc., it becomes highly advisable to document and maintain this list separately.
    – Skyhawk
    Oct 15, 2010 at 3:41
0

I can't recall the exact location of the setting in exchange 2007, but in exchange 2003 there is a dialog for "Outbound Security" under connector settings where you can uncheck all options (anonymous, windows) except TLS, in effect enforcing TLS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .