Here's our Exchange 2007 Scenario. (2 Exchange Servers on a different forest)

For ABC.COM Exchange domain 250 mailbox users 300 mail contacts that we added to represent the other Exchange DEF.LOCAL domain users 60 Distribution groups

For DEF.LOCAL Exchange domain 200 mailbox users 350 mail contacts that we added to represent the other Exchange ABC.COM domain users 80 Distribution groups

The primary email address we are using that is configured in Exchange server is DEF.NET. Basically, for us ABC.COM users, we can send outgoing email and we can also receive incoming email as long as the email address is ABC.COM. But if someone wants to send an email to our DEF.NET email address, we need to ensure that the corresponding ABC.COM user mail contact is created in the DEF.LOCAL Exchange Server Mail Contacts section with an smtp address of user@DEF.NET.

In addition, in order for us to be able to send emails to users of DEF.LOCAL, we also need to ensure that their corresponding DEF.NET mail contact is created in the ABC.COM Exchange Server Mail Contacts section with an smtp address of user@DEF.net

This is also the same case of DEF.LOCAL Exchange users. Since their primary address is DEF.NET, they have no problem of sending and receiving emails from outside. But since the company requires us to use DEF.NET as the primary email address for both Exchange domains, in order for DEF.LOCAL users to be able to send emails to ABC.COM, the corresponding ABC.COM mail contact is created in the DEF.LOCAL Exchange Server Mail Contacts section with an smtp address of user@ABC.com.

By the way, both domains have domains trust in each other as well. The AD/DC OS on both forests are running Windows Server 2003 Standard. The version of the Exchange we have is Exchange 2007 SP3 installed on a Windows Server 2008 OS.

I am looking at GALsync program (http://www.msexchange.org/articles-tutorials/exchange-server-2003/migration-deployment/GAL-Sync-Identity-Integration-Feature-Pack-IIFP.html) but I am not sure if this will solve everything. Basically, since we're able to see users from the two Exchange domains with the use of Mail Contact, the objective now is for us to be able to see the corresponding distribution groups for both Exchange domain within Outlook GAL. As of now, the only way for us to be able to send email to the distribution group across the other Exchange domain is to create a corresponding mail contact of the particular distribution group. Although that works, it would sure be nice if we could also see the members of the distribution group as well from the other Exchange domain.

Thanks for taking the time to read this and thank you everyone in advance for the help and advice.


I have done a setup just like you are asking, albeit with Exchange 2010 which is somewhat different than 2007 in this regard. It will handle distro lists, etc. Be cautious about having the same ones cross-forest though...like helpdesk or sales or whatever.

Basically it comes down to 3 things:

  1. You should (if you don't already) have a shared SMTP namespace for DEF.NET. This will make sending and receiving as DEF.NET for EVERYONE...and simplify the namespaces used. You can do this cross-forest.
  2. Exchange 2010 simplifies this part, but it is still doable in Exchange 2007 with the latest SP I believe. Look into Cross-Forest Federation, if needed. Basically this will allow for cross-forest resource availability and free/busy sync. Helps for meetings, etc
  3. We used (and I highly recommend) a product by netsec.de called GAL Sync...http://www.netsec.de/en/produkte/galsync/ It is made by a German company but it has full english support and works amazingly well. It will require setting it up on both sides, but it works so well with so many customizable options. We had looked into all the others, like IIFP (now ILM), Quest Collaboration Services, doing it in house, manual contacts on both sides, etc.

This isn't for the faint of heart overall though. You have to really make sure you do it right, because Exchange is finicky. Take for instance a single contact you already have on the other forest. Now delete it and recreate it and watch what happens when someone tries to reply to an existing email from the original "contact". It will bounce because it is looking for that original Exchange object, not the smtp address. So be careful and go slow. Even with the above options, it took me a few months of planning and testing to make sure go live would go smoothly.

| improve this answer | |
  • Thanks TheCleaner. I have asked GALsync for price quote and more information. Basically, the way they priced things is the number of objects I need to sync. So, if I'm already seeing mail contacts under Outlook client, does that mean that I need to purchase would be the number of groups/distribution groups on both domains that I want to see? If that is the case, then the moment GALsync does its job, will I be able to finally send an email to the distribution group on the other domain as well as see the corresponding members of that particular group? Thank you. – GeePee Dec 3 '13 at 3:47
  • All GALsync does is create mail-enabled contacts on each end automatically and keeps their details up to date. So if creating a distro manually today on the other side works, then yes to sending an email. Corresponding members in the group? No...I don't think so...since it's not a real distribution group, but a mail-enabled contact. As far as price goes, I know it is by # of objects, but we needed everything synced...basically a unified GAL and everything...so I'm not sure how they'll price just distro groups. – TheCleaner Dec 3 '13 at 13:51

Even though its a program you have to pay for, check out Quest Collaboration Services (now owned by Dell). It is a GAL syncing program and works quite well. You can sync user object, contacts and mail enabled groups (DL's) with members between two different forests so they show up in the GAL. It does not require a trust to do the GAL sync. It uses emails with encrytped attachments that contain the sync information that goes back and forth between forests.

| improve this answer | |
  • Thanks Andrew. I will ask Dell about Quest Collaboration Services. In a way, I only would need to sync all groups/distribution groups on both domains so that I would no longer need to create an equivalent mail contact to that specific group, right? As long as the mailbox user can see who are the members of the distribution group on the other domain, then we're good. I hope Dell does not charge an arm and a leg though. Thank you. – GeePee Dec 3 '13 at 3:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.