A client has been using IIS v6 SMTP over Windows 2008 R2 for many years to send out automated server notifications. Their apps use Blat to send through localhost with no authentication. Email seems to go out directly from that system with a masquerade FQDN that is the same as their actual email server. Only their staff email (Outlook, etc) goes through the real SMTP server.

We're migrating most functionality to a new Windows 2016 server and I need to ensure all email automation is working correctly. I'm concerned that remote servers that check SPF or DKIM or other certification will either bounce or silently trash emails from this server. I believe the number of remote servers doing this is quite likely to increase over time.

But I have not found what I expected to be an outcry from admins about issues like this, only the occasional old questions about how to relay to GMail or some other server. I do not see a folder full of bounces. And I get emails from this server - unfiltered by my third-party email host.

So my fears don't seem to match with reality and I can't justify a recommendation to change the setup on their new system. That's fine, I don't have an agenda, I'm really looking to ensure that things just work, regardless of how it works.

1) Am I correct that recipient servers could/will/should be filtering these outbound notifications, and the intended recipients might not even be getting their emails?

2) Is it better to just use a "real" SMTP server like Exchange or Postfix?

3) Is there any downside to continue using Blat, with Basic Authentication into localhost, and continuing to use IIS SMTP to send email from their v2016 server?


  • It seems I've made an error in SE protocol by asking three questions. If two different people answer two different questions, the marked answer will be unfair or ambiguous. I'll try to fix this when we're done.
    – TonyG
    Sep 19 '18 at 2:24

Have you looked to see what the configuration of the old SMTP server is? Maybe it's relaying through a smarthost?

Anyway, SPF and DKIM only apply to the immediate connection. So if your Blat server connects to a local mail relay app, which then sends to your Exchange server, which then handles final delivery, then it's only that last hop (Exchange to final) that will be subject to SPF and DKIM.

  • I understand what you're saying about the immediate connection. The "Masquerade domain" is the only reference to their actual "mail.foo.tld". Is that where it sends outbound mail? There is no smart host specified. For now, let's assume it is going out through the legit server. Is there any known issue with continuing with this IIS relay in Win2016?
    – TonyG
    Sep 19 '18 at 2:23
  • I setup IIS+SMTP in the new server with relay to the primary email server. That server needs to authorize this relay box. It doesn't look like there is any problem with this configuration. I believe the answer by @longneck was enough to get me on my way here so I'm closing this by accepting this answer.
    – TonyG
    Sep 23 '18 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.