And that, if that domain doesn't have TLS turned on, email-sending fails? I've been looking at setting up SMTP send connectors, but there doesn't seem to be an option to enforce TLS?
2 Answers
Yes, if you're using Exchange 2007 or 2010 just create a send connector and specify the domain in question as a remote domain.
Then use powershell to enable or disable TLS. Be sure to configure a certificate using Get-ExchangeCertificate and New-ExchangeCertificate. Take note that by default the expiration is in one year.
Next, edit your send connector to use TLS with TLSSendDomainSecureList ...
Here are step-by-step instructions: http://technet.microsoft.com/en-us/library/bb123543.aspx
-
1Strangely, Microsoft provides no way to manage this list by adding or removing one domain at a time. If one anticipates multiple "mutual TLS" relationships with clients, vendors, etc., it becomes highly advisable to document and maintain this list separately.– SkyhawkOct 15, 2010 at 3:41
I can't recall the exact location of the setting in exchange 2007, but in exchange 2003 there is a dialog for "Outbound Security" under connector settings where you can uncheck all options (anonymous, windows) except TLS, in effect enforcing TLS.