Win Server 2K8 - Setting up SMTP Server

Question

I'm setting up an SMTP server behind NAT. I'm a bit confused about the DNS requirements as I thought I could just setup the SMTP server and allow connections from the internal IP address on the machine and it would send out emails fine.

Now, I can get it sending emails to gmail accounts, but on other email accounts it seems to not be able to connect to their mail server.

I've read something about reverse DNS lookups - do I need to put in place some DNS records for a domain so the other mail servers can do a reverse lookup and check that I'm legit? Currently, the emails just come from the external IP address of the server.

Update

The email sending problem has been identified as being non-standard line-endings in text only email. Make sure you use "\r\n" instead of "\n" in text emails as some mail servers will reject your messages otherwise!

Answer 1

I second what DrStalker said, a lot of ISPs will block :25 to stop people from doing exactly what you're doing "For security purposes", but most will also lift it if you ask them to.

The other thing you need to look at are your MX Records in your DNS. The MX (or Mail eXchanger) record tells the mail servers where to deliver mail, as most mail servers are NOT on the web server.

For example, your web server is on x.x.x.1 and your mail server is on x.x.x.2. Your A record for www.example.com points to x.x.x.1 - great for web browsers, but not so great for delivering mail. To get around this, you create an MX record for www.example.com that points to x.x.x.2.

A few things to note for an MX record:

1. It MUST point to an A record for a Fully Qualified Domain Name
2. It CANNOT point to a CNAME
3. It CANNOT point to an IP address

So, you might set up an A record for mail.example.com and point it to x.x.x.2 and your MX for example.com to mail.example.com.

Has your head exploded yet?

It's worth noting that this method is only required if your Mail Server and your Web Server are on different public IP addresses. If they're on the same public IP and you just forward you mail based on the port at the router, then you don't need to do it. However, it's very good practice to have an MX for every domain you expect to receive mail for, even if you just point it to the A record for your zone.

Your query regarding Reverse DNS is only applicable for when you are sending mail. If you are able to send to gmail.com chances are that you're fine (most commercial or residential IP addresses have a reverse DNS configured, it just points to a PTR record on the ISP's DNS), and that it's got nothing to do with receiving mail.

Answer 2

There's not much you need to do. I'm not sure why it would work to gmail and not elsewhere; exactly how many different domains have you tried sending to?

1) Check your SMTP logs. Enable logging if it's not enabled (use IIS Admin).

2) Make sure that you can resolve locally the mail domains you can't send to.

3) Try running telnet to port 25 on the server(s) you cannot connect to. It's easy enough to manually send an email using this method.

NOTE: checking your logs can eliminate the need for 2 & 3 usually.

4) Enabling reverse DNS will require that you contact your ISP and have them configure it for you. This is definitely a criterion by which mail servers / spam filters will reject email, although it's not universal.

5) If you've got any sort of firewalls that filters SMTP, disable them (even check your internet router, especially if it's Cisco).

6) Make sure that you've setup SMTP correctly: http://www.itsolutionskb.com/2008/11/installing-and-configuring-windows-server-2008-smtp-server/

Answer 3

Does your ISP allow you to send out SMTP traffic? a lot of ISPs block this; to check try manually connecting to the remote server on port 25. If that doesn't work you need to either get the ISP to open outbound SMTP traffic, or configure you SMTP server to relay mail through the ISP's SMTP server.