I'm trying to set up a receive connector that will allow a web based CRM to relay mail. So far, it works, but only if the user I use to login is in the group "Domain Admins" in active directory.

Here are the settings I have checked for the receive connector:

  • Security - Authentication: Transport Layer Security, Basic Authentication
  • Security - Permission Groups: Exchange Users, Anonymous Users
  • Scoping - IP Addresses: Addresses of the CRM, and my IP address for testing purposes.
  • Scoping - Network Adapter Bindings: All available IPv4, Port 25.

And here's the steps I'm going through to send an email:

telnet (server fqdn) 25  
auth login    
(username in base 64)    
(password in base 64)
"Authentication successful"
mail from: (email address)
"sender ok"
rcpt to: (my email addres)
"recipient ok"
subject: test
"250 Mail queued for delivery."

And I never get the email, it doesn't show up in the queue, or in the SMTP logs. But if I add the user to the "Domain Admins" group in Active Directory Users and Computers, and repeat these steps, everything looks exactly the same, but I do receive the email. Currently, the test user is only a member of "Domain Users". Any ideas?

  • Does your CRM send email only from its own account, or does it send on behalf of other users (ie pretending to be those users)? – roaima Feb 18 '15 at 21:24
  • Sends on behalf of other users, I need to supply it with credentials to the Exchange server. – PeterA Feb 19 '15 at 13:32
  • Is the email address to which you're sending part of your Exchange system, or is it an external address? If it's external what happens when you try to send to a local Exchange email address? – roaima Feb 19 '15 at 18:49
  • I had been trying to send to an external address. I just now tried to send to a local Exchange address and it's doing the same thing - "250 mail queued for delivery." but it doesn't go through, nothing in the queue, no bounceback, not in junk/spam firewall. – PeterA Feb 19 '15 at 20:54
  • 1
    SOLVED: I got it figured out. Opened wireshark on the mail server, and it was giving a "550 5.7.1 Client does not have permissions to send as this sender\r\n", so I went into the ECP > Recipients > Edit "recipient name" > mailbox delegation > Add Send As > and I added the user, giving it send as permissions to its own mailbox. Thanks for your help! – PeterA Feb 26 '15 at 15:15

You've already configured the transport connector that's specific to your CRM; that's good. You've got "Anonymous users" ticked? That will allow your CRM system to send on behalf of your local users.

Now, assuming the connector is called "CRM", also run this powershell snippet

Get-ReceiveConnector "CRM" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "Ms-Exch-SMTP-Accept-Any-Recipient"

What this does is to tell Exchange that your CRM system is to be permitted to use Exchange to relay through it to non-local users. (I don't recall whether this was required on my 2010 system to deliver to local users, too, but I do recall plenty of frustration on this matter. So much so that my notes became incomplete as I tried one thing after another.)

This link to Elan Shudnow's blog post on the matter may also help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.