Forcing all Exchange-to-Exchange (2010) e-mail to go via an outside SMTP gateway

Question

We want to force all our e-mail to go via an SMTP server for virus scanning, spam scanning and some tags that we use internally.

Is this possible? We configured Exchange's smarthost property and that works for all e-mail except those that are recognized as local users on Exchange.

Answer 1

If it were possible, the market for "Exchange antivirus software" would be a very different one. Microsoft created the "Transport Agent" framework to allow programmatic access to the email flow in an entire Exchange system, to/from the internet, and to/from internal users as well. You will need to leverage that system to do what you want.

It can be done, but your software has to be able to leverage the hooks. It is perfectly possible for such systems to do the AV role (that's how all Exchange AV systems have to work) as well as rewriting emails (adding headers, changing subject-lines, whatnot), and just extracting information from the email to put somewhere else.

Answer 2

I'm not sure this is possible, since this is how Exchange is designed to work.

The problem you have is that you have (for example) acme-widgets.com defined in Exchange as a domain it is authoritative for, therefore it accepts all mail for acme-widgets.com and delivers it locally if the address exists (and bounces it otherwise). There's no point sending an email to another SMTP server for it to be sent straight back.

If you were to send all your mail to an external SMTP provider, you'd create a bit of a paradox which would go something like this.

1. Receive mail and send to external SMTP server
2. External SMTP server does its thing and sends the message to your email server
3. Go to step 1

Infinite routing loop, anyone?

Answer 3

You might be able to slap a workstation with two NICs running Untangle as a "transparent bridge" in front of your Exchange Server; that'll scan/filter all traffic destined for your Exchange Server (including malware, spam, etc.) but it would probably be easier just to install proper anti-virus/spam on the mail server itself.

Having said this, if you're seeing alot of internal spam, sounds like you have bigger issues (like a spambot on your network). Clean it up at the source and make sure you drop outbound TCP 25 traffic at the firewall (with an exception for your mail server obviously).