Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

And that, if that domain doesn't have TLS turned on, email-sending fails? I've been looking at setting up SMTP send connectors, but there doesn't seem to be an option to enforce TLS?

share|improve this question

Yes, if you're using Exchange 2007 or 2010 just create a send connector and specify the domain in question as a remote domain.

Then use powershell to enable or disable TLS. Be sure to configure a certificate using Get-ExchangeCertificate and New-ExchangeCertificate. Take note that by default the expiration is in one year.

Next, edit your send connector to use TLS with TLSSendDomainSecureList ...

Here are step-by-step instructions:

share|improve this answer
Strangely, Microsoft provides no way to manage this list by adding or removing one domain at a time. If one anticipates multiple "mutual TLS" relationships with clients, vendors, etc., it becomes highly advisable to document and maintain this list separately. – Skyhawk Oct 15 '10 at 3:41

I can't recall the exact location of the setting in exchange 2007, but in exchange 2003 there is a dialog for "Outbound Security" under connector settings where you can uncheck all options (anonymous, windows) except TLS, in effect enforcing TLS.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.