Question about mail server settings for new ISP

[Oaktech]

Hi all,

 

we are moving away from our SWGfL connection at the the end of the month. Our new ISP is Gigler/City Fibre

 

We are using exchange 2003. Our external DNS provider is vidahosts, we have an MX record with them for our domain of in.mx.ifl.net, the smtp connector set in the exchange server is mx.swgfl.ifl.net

 

what do I need to do to migrate our exchange server from SWGfL?

 

Please use small words as this side of networking is not my forte!

[ZeroHour]

You basically need to get your ISP to tell you you're new ip, then add a subdomain such as ext.SCHOOL.sch.uk which points to that ip. Update your MX record on your domain to point to the new record and mail will flow to your exchange directly. You must obviously port forward etc but that should be it for incoming.

Outgoing wont need an smtp connector/server unless you're new isp blocks smtp coming direct from your exchange, you're exchange can now directly send the mail to other peoples servers rather then going through the external connector.

While you have you're editing you're domain dns records (not internal dns) you should take the time to add a TXT record based on SPF (sender policy framework) which lists the ip's that are authorised to send mail from you're schools email domain. This will prevent issues with spam filtering when sending mail out.

 

Pro Tip: BEFORE the week/day before moving change you're schools current MX records to expire after 5 minutes rather than longer, that way when you do update the records the changes are live faster, it also means if anything breaks you can switch back the mx record and you wont lose hours waiting for the web to update their caches.

 

NOTE: I have not dealt with SWGFL, this is just general advice and SWGFL may have their own idiosyncrasies.

Edited August 9, 2013 by ZeroHour

[twin--turbo]

Make sure your ISP also puts in a reverse DNS pointer for your server IP.

 

Do you have any inbound spam/virus protection , this may have previously been done by your RBC.

 

Our mail goes in and out via a ClearOS mail relay for filtering.

 

Rob

[ZeroHour]

Make sure your ISP also puts in a reverse DNS pointer for your server IP.

 

Forgot about that, didnt think reverse matter so much for spam protection any more but I would add it anyway. That record should match your ext.SCHOOL.sch.uk record name.

[Oaktech]

Ok, I said small words guys... Feeling pretty stupid today sorry!

 

Lets review...

 

Our ISP is dumb, we don't get anything except a connection and some external IPs from them.

 

We have a DNS management arrangement with VidaHosts. Our MX record for our domain with them reads:

Domain: leaf.bournemouth.sch.uk

Record type: MX

TTL: 86400

Priority: 10

Content: in.mx.ifl.net

 

Our Exchange server has an SMTP connector of: "forward all mail through this connector to the following smarthost: mx.swgfl.ifl.net".

 

We currently have an external subdomain of mail.leaf.bournemouth.sch.uk that our OWA uses and runs into the SWGfL provided external IP (it will be changed over to the 84 range IP on monday when I change the default route in our core switch, we are running 2 connections atm for business continuity and testing)

 

We currently have a rule on our PaloAlto box to allow the following application signatures to traverse: Outlook web, SMTP, SSL, HTTP. The rule accepts these applications from any external source to the external IP of the mail server 84.45.115.120 and allows to traverse the firewall to the rule for the mail server internal address. There is a corresponding rule for outgoing limited to SMTP signature.

 

We have an MX record in our internal DNS for our domain.internal of the mail servers internal fqdn

We have an MX record in the internal DNS for our leaf.bournemouth.sch.uk external domain addressed to the mail servers internal fqdn

 

I can't see anywhere in our vidahosts DNS management to create a reverse dns record for our mail. My options are: A, AAAA, CName, MX, TXT, SPF, SRV.

I see that I can create both TXT and SPF records in VidaHosts which do I want?

 

 

Could you possibly do me a step by step as I really am not strong on this bit, having never had to deal with it before.

[localzuk]

Reverse DNS is handled by your ISP, not your DNS host.

[twin--turbo]

Reverse DNS is handled by your ISP, not your DNS host.

 

Yep. As dumb as they may be, they have to do it as it's their DNS record relating to the static IP address when doing a reverse lookup.

You could also ask them if they have a SMTP mail realy you can use for outbound mail

 

 

 

on the vida control pannel create a new A record mail.

 

mail1.leaf.bournemouth.sch.uk 84.45.115.120

 

create an MX record pointing to

 

mail1.leaf.bournemouth.sch.uk

 

 

 

 

 

 

 

Do you have filtering??

[Oaktech]

Thankyou for that!

 

Filtering?

 

We have a junk mail filter on our exchange server which delivers junk to staff junk mail folders and deletes it for students. Also the ESET for exchange examines and strips dangerous attachments.

 

What do I do on our DNS to allow the outbound stuff? Or have I done enough and I just need to select 'use dns' in the exchange manager?

[twin--turbo]

Filtering:

 

How are you classifying incoming mail as junk?

 

 

If you tick DNS is shoud indedd use direct delivery without needign the SMTP relay.

 

Rob

[Oaktech]

We have intelligent message filtering set up to an SCL of 5, and store junk set to an scl of 4 we have an arrangement with a local IT company who send us, for free, block lists for sender and connection filtering which is added manually once a month.

[ZeroHour]

Change your ttl now! You want that set low for a few days before doing the switch. Really mx records are fine with 2 hour ttl normal use and if you know changes are coming you set it to 5 - 15m so changes are rolled out faster.

[Oaktech]

Ok... We've done it.

 

Cross your fingers everyone...

[Oaktech]

It *seems* to be working atm...

 

And Breathe!

[twin--turbo]

 

Well done.

 

Although I don't seem to get a telnet session to your SMTP @84.45.115.116?

 

 

Rob

[twin--turbo]

 

Well done.

 

Although I don't seem to get a telnet session to your SMTP @84.45.115.116?

 

 

Rob

 

Scratch that wrong ip ,

 

Connects fine

[Oaktech]

116 is the webserver, our Palo blocks this, and telnet is disabled. I'd be worried if you could...

 

[twin--turbo]

mxtoolbox reports you may be open relay and reverse DNS not valid.

 

Rob

[Oaktech]

reverse DNS may not have been actioned by ISP yet... How do we deal with open relay then?

[twin--turbo]

Looks like relay is refused "550 5.7.1" when testing it.

 

Do some testing of your own though to be sure using the command line from outside the school.

 

Rob

[Oaktech]

Ok, ISP is being a bit awkward, I don't know what the reverse DNS should be and they are pumping me for the information...

 

Does the reverse DNS need to be set to our email domain of leaf.bournemouth.sch.uk or our sendmail subdomain of mail1.leaf.bournemouth.sch.uk?

 

Sorry for all the questions, but I've not really ever had to deal with the outside world before!

[twin--turbo]

mxtoolbox reports it as possibly open but it does not seem to be.

 

you should see some tests to/from my "f2s.com" account in your message trackign taht should indicate what is preventing the message being sent.

 

Rob

[Oaktech]

I'm not seeing any messages at all from that domain...

[twin--turbo]

I'm not seeing any messages at all from that domain...

 

Use powershell for wildcards.

 

Wildcard searches in Exchange message tracking | Scotts IT ramblings

 

 

may require some playign with, you will want to run your own tests.

 

 

Rob

Edited August 12, 2013 by twin--turbo

[twin--turbo]

replace where{$_.sender...... }

with

where {$_.recipiens -like "*@f2s.com"}

 

watch out for the date format as it may be mm/dd/yyy

 

 

Rob

[Oaktech]

I can't get this to run - we don't use powershell much and it is being blocked!