Unauthenticated Proxy - What solutions are people using ?

[rich_tech]

Hello all,

 

I am in the middle of a mail migration to Office365 for the company I am working for, phase1 has gone fine so far with only minor account related issues - I got everyones mailboxes over to O365 fine.

 

Phase 2 which I am in now, I need to get a solution in place to allow Unauthenticated Email forwarding - we have a number of legacy/bespoke systems that are in operation that do not use authenticated email accounts which need to be able to email.

 

I have tried so far doing an IIS SMTP relay, but despite spending 2+ hours working through many scenarios, instructions and blog posts I am unable to get that working with Office365 to send the email.

 

What I want to know is has anyone else here done this before and is there another product or service that has been used ? or does anyone have a set of instructions on how they actually got O365 to do this with IIS relay.

 

Thanks,

 

Rich

[FN-GM]

I use this method. Works a treat. Easy to setup and can all be done within Office 365 itself

 

https://support.office.com/en-us/article/How-to-set-up-a-multifunction-device-or-application-to-send-email-using-Office-365-69f58e99-c550-4274-ad18-c805d654b4c4?ui=en-US&rs=en-US&ad=US

[rich_tech]

cheers @FN-GM I didnt realise that you could do direct send with O365, that looks more likely a solution for us, some of this stuff refuses to use authenticated emails, just wants an IP and address and the SMTP relay solution doesnt work for us after wasting an afternoon faffing about with it.

[FN-GM]

Sounds all too familiar!

[Steve21]

We use a local IIS relay, although you can do settings in O365 direct we found a lot of "old old" stuff won't support them still for the amount we needed as some won't accept username/password combos, e.g. legacy printers/systems blahblah.

 

We have the printer/device pointing to our IIS locally without any authentication (This is restricted by the IP of the devices). Then the IIS relay connects with an authenticated account to o365 to send the emails.

 

*Edit - On a site note 2 other reasons we didn't use Direct Send, a) it opens it up to all devices so anyone could use it without us authorising it, b) you can't use it for external messages, so like we have our MFDs on contract so it emails external companies with details of things like toner levels

 

Steve

Edited October 30, 2016 by Steve21

[Steve21]

These are our settings, few bits greyed out but thought it might help if you go this route Shout on any queries

 

 

Steve

Edited October 30, 2016 by Steve21

[Edu-IT]

@rich_tech When you say it isn't working, is it just that mail isn't sending? Have you tried it through command line to test?

 

You will need to use whatever address you've used as outbound authentication (smtp@ in this case) as the sender address for it to work. So all your devices will need to send as smtp@. At least I believe that is the case.

[FN-GM]

*Edit - On a site note 2 other reasons we didn't use Direct Send, a) it opens it up to all devices so anyone could use it without us authorising it,

 

Steve

 

We lockdown this on our firewall.

 

you can't use it for external messages, so like we have our MFDs on contract so it emails external companies with details of things like toner levels

 

We use it to email external users?

[Steve21]

We use it to email external users?

 

Using direct send? Never been able to do that according to MS unless it's changed? (You are using option 2 right?)

 

From that link you did above:

You only need to send messages to recipients in your own organization who have with mailboxes in Office 365; you don't need to send email to people outside of your organization.

Direct send cannot be used to deliver email to external recipients, for example, recipients with Yahoo or Gmail addresses.

 

Might have changed I guess but that's some of the reasons we never did it

 

Steve

[Steve21]

@rich_tech You will need to use whatever address you've used as outbound authentication (smtp@ in this case) as the sender address for it to work. So all your devices will need to send as smtp@. At least I believe that is the case.

 

The alternative is to give that account (SMTP in my case) send-as permissions on another box. So our SMTP have send-as on MFD1 MFD2 etc (As we had the same issue in regards to needing to send from multiple emails with one relay)

 

Steve

[rich_tech]

Can someone clear up this detail from what I have read as I am trying to work through this today to get this stage nailed so I can dehook the exchange server we have hosted - the fact that my domain name suffix - sitename.local - does not match the email domain name - i.e. company.co.uk - is supposedly an issue from somewhere I read.

 

Is that likely to be a case on this as I cant find a definitive answer.

 

Also - am I able to set this relay machine up as a direct send device and get around any issues that way ? or is the fact that my FQDN is different to the mail domain likely to cause further agro ?

 

Thanks,

Edited November 3, 2016 by rich_tech

[rich_tech]

SMTP test to the telnet on the domain goes through fine on the port 587

 

 

[ATTACH=CONFIG]39554[/ATTACH]

[Steve21]

In regards to sending SMTP? No problem at all. We have school.sch.uk as our internal, and school.wilts.sch.uk as our email.

 

End of the day you're sending SMTP internally to "IP" address, then the server is sending it out to the correct domain etc. The internal name doesn't make a bit of difference in that (Not sure about DirectSend)

 

Steve

[rich_tech]

I am at a bit of an impasse here with the SMTP relay, because I have several legacy apps that need to send unauthenticated emails, I have done countless tweaks and setups of the IIS relay following various amounts of instructions of which nothing has worked so far.

 

Its not a firewall issue, as I have rules in place specifically allowing it to connect and I have run the telnet session from the server, but it will not send, I have solarwinds orion running and using that to test it and from a server point of view the machine is setup and showing as test successful in pointing to the server internally for SMTP, it reports that the test email has gone out fine, but it will not mail anything externally from the box as I dont receive the email in my box.

 

Its very frustrating to say the least here.

 

I am now setting it to have a specific account - SMTP@ just for this purpose to see if that is an issue.

Edited November 3, 2016 by rich_tech

[Steve21]

Any chance of getting screenies of all the setup? Could take a nosy.

 

In regards to the test, does the mail arrive to the relay? Does it drop it? Whats the relay log show?

 

Steve

[rich_tech]

Just wanted to say, thanks for all your help, this has now fired up and started working, I did three things which seem to have been a cure, though I am not 100% on what had the effect to make it fire up and at this stage I am too scared to try and see what it was.

 

1. I made a specific single user - [email protected] after seeing that on here, this is not a shared mailbox, the other two accounts I used before were shared.

2. I added in an additional pair of IIS Role services to the server - IIS Client Certificate Mapping Authentication and IP Security after reading through an MS webpage.

Went to lunch after triggering a test and came back to the test email from an internal server here.