Exchange 2010 not receiving all email

[Jawloms]

I have recently moved to Schoolsbroadband. I used to get my Internet provided by the LA, who also provided a Smart Host for my mail relay. Now I am with Schoolsbroadband I am not going through a Smart host. I am not receiving all my incoming email, as you may have seen in another thread. Schoolsbroadband are being no use whatsoever and don't seem to deem it important that we aren't receiving emails from the DFE, some parents, and other places. My external IP is 85.92.188.117. The PTR record, according to mxtoolbox is for mail.debenhamhighschool.suffolk.sch.uk. All of our outgoing email is from @DebEnhamhigh.co.uk email addresses. I am tearing my hair out with this, and the head is getting understandably twitchy.

 

Should my PTR be mail.debenhamhigh.co.uk as that is what our email addresses are?

Should I have two PTRs, one for mail.debenhamhigh.co.uk and one for mail.debenhamhighschool.suffolk.sch.uk on different external IP addresses which then forward to my exchange server?

What else am I missing?

Are there other settings I should have changed on my exchange server now that I am not going through a smart host?

Do I need to do anything with any certificates anywhere?

Help?!

 

Anything gratefully received.

 

Thank you

 

Stuart

[Jawloms]

Anyone please? This has been going on for days and we are missing critical emails. What can I check?

 

Thank you

 

Stuart

[Gdog]

No longer have exchange to get the exact page up for reference, but have you looked what the exchange receive connector is set as, Its not only accepting from certain IP's is it?

[Domino]

An SMTP test shows you're not offering TLS - anything setup for mutual TLS security will fail. A lot of providers are insisting upon it.

 

Do the senders get a bounce from these missed mails? if so it'd be helpful to get the detail.

[Jawloms]

No longer have exchange to get the exact page up for reference, but have you looked what the exchange receive connector is set as, Its not only accepting from certain IP's is it?

 

Set up to receive email from all IPs. This may be wrong, but should at least work shouldn't it?

 

An SMTP test shows you're not offering TLS - anything setup for mutual TLS security will fail. A lot of providers are insisting upon it.

 

Do the senders get a bounce from these missed mails? if so it'd be helpful to get the detail.

 

Presumably on "Server Configuration" -> "Hub Transport" -> "Receive Connectors"?

"Transport Layer Security (TLS)" was ticked, I have now ticked the box underneath which says "Enable Domain Security (Mutual Auth TLS)".

"Basic Authentication" was ticked, I have now ticked the box underneath which says "Offer Basic authentication only after starting TLS".

 

Is that what you mean?

 

NDR here;

 

Subject: Undeliverable: RE: Sharp and Microsoft

 

Delivery has failed to these recipients or groups:

Stuart Hawkins ([email protected])

Your message wasn't delivered. Despite repeated attempts to deliver your message, a connection to the remote server couldn't be made.

Contact the recipient by some other means (by phone, for example) and ask them to tell their email admin that it appears that your email system is unable to connecto their email system. Give them the error details shown below. It's likely that the recipient's email admin is the only one who can fix this problem.

For more information and tips to fix this issue see this article: https://go.microsoft.com/fwlink/?LinkId=389361.

 

 

 

 

 

Diagnostic information for administrators:

Generating server: LO1P123MB1203.GBRP123.PROD.OUTLOOK.COM

Receiving server: LO1P123MB1203.GBRP123.PROD.OUTLOOK.COM

[email protected]

4/15/2018 8:10:50 AM - Server at LO1P123MB1203.GBRP123.PROD.OUTLOOK.COM returned '550 5.4.317 Message expired, cannot connect to remote server(454 4.7.5 Certificate validation failure)'

4/15/2018 8:01:35 AM - Server at debenhamhigh.co.uk (85.92.188.117) returned '450 4.4.317 Cannot connect to remote server [Message=454 4.7.5 Certificate validation failure] [LastAttemptedServerName=debenhamhigh.co.uk] [LastAttemptedIP=85.92.188.117:25] [LO2GBR01FT007.eop-gbr01.prod.protection.outlook.com](454 4.7.5 Certificate validation failure)'

Original message headers:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=simplyitgb.onmicrosoft.com; s=selector1-simplyitgb-co-uk;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;

bh=kixuWp8ygiU2Hb8OrNpvY6gihfGsE/8s6J7BkcEEqlU=;

b=kDSrLMUgk5FSPkWr9TXpkgjjUv9PLwS860hebLWvG60nRy8SpD+kcoualMU5tgMdABREHNpPmLYAqRVYrCnQeLGaVp0HlRpwnC3DqS90b7xKGFvhs1t66NeYh5kcoXRKScZmLTBN3Re+NoYw9DdhsqpQwgtG7JG4W/0o6dY6tXA=

Received: from LO1P123MB1203.GBRP123.PROD.OUTLOOK.COM (2603:10a6:c00:a::24) by

LO1P123MB1203.GBRP123.PROD.OUTLOOK.COM (2603:10a6:c00:a::24) with

TransportReplication id Version 15.20 (Build 675.13); Fri, 13 Apr 2018

08:05:06 +0000

Received: from LOXP123MB1286.GBRP123.PROD.OUTLOOK.COM (10.166.254.22) by

LOXP123MB1205.GBRP123.PROD.OUTLOOK.COM (10.166.252.150) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id

15.20.653.12; Tue, 10 Apr 2018 08:23:24 +0000

Received: from LOXP123MB1286.GBRP123.PROD.OUTLOOK.COM

([fe80::4525:9d99:363a:ffe]) by LOXP123MB1286.GBRP123.PROD.OUTLOOK.COM

([fe80::4525:9d99:363a:ffe%13]) with mapi id 15.20.0653.017; Tue, 10 Apr 2018

08:23:24 +0000

From: "Nichola Oates (Simply IT)"

To: Stuart Hawkins

Subject: RE: Sharp and Microsoft

Thread-Topic: Sharp and Microsoft

Thread-Index: AdPLMWTJC1xKI0CiQ2Kubzm4RvHQfQABH5TQAABoHNAALLzMcAEuoXKQ

Date: Tue, 10 Apr 2018 08:23:24 +0000

Message-ID:

References:

<7950CFF534A79145A01DB698C36E6C88569E261A@DHS-Exchange.debenham-cc3.internal>

<7950CFF534A79145A01DB698C36E6C88569E6C3A@DHS-Exchange.debenham-cc3.internal>

In-Reply-To: <7950CFF534A79145A01DB698C36E6C88569E6C3A@DHS-Exchange.debenham-cc3.internal>

Accept-Language: en-GB, en-US

Content-Language: en-US

X-MS-Has-Attach: yes

X-MS-TNEF-Correlator:

authentication-results: spf=none (sender IP is )

[email protected];

x-originating-ip: [82.152.146.127]

x-ms-publictraffictype: Email

x-microsoft-exchange-diagnostics: 1;LO1P123MB1203;7:f+WHxZTiiHuVdToeV7U5HXLhdyStuNB4WHlISce+o4cF14VHwlsd11FlubnXjo06BIop2YrPe9QFH6PSAh7hAMKjDAwmw/T/VT8dtGByeod0FJ5hSykQ5IUq6IiYfPlaVVxfYNw2LVALWzjGcnGVoc0FoTz9Qk3WFWGITzb0RfIpoIH8goHbMZUzvOQYb7lWFCQO6o5B53s8eAmExWF09Vt0KvF6AlZMK478cP82WWdbcJXlmEXyYA283L+6/fBm

x-ms-exchange-antispam-srfa-diagnostics: SOS;

X-MS-Office365-Filtering-Correlation-Id: e64d5454-630e-45e0-2483-08d59ebc53fc

x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(4652020)(7021125)(5600026)(4604075)(3008032)(4534165)(7022125)(4603075)(4627221)(201702281549075)(7048125)(7024125)(7027125)(7028125)(7023125)(2017052603328)(7153060)(49563074)(7193020);SRVR:LOXP123MB1205;

x-ms-traffictypediagnostic: LO1P123MB1203:

x-microsoft-antispam-prvs:

x-exchange-antispam-report-test: UriScan:(28532068793085)(21748063052155);

x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(102415395)(6040522)(2401047)(5005006)(8121501046)(3231232)(2017060905117)(944501327)(52105095)(10201501046)(3002001)(93006095)(93001095)(6041310)(20161123562045)(20161123558120)(2016111802025)(20161123560045)(20161123564045)(6043046)(6072148)(201708071742011);SRVR:LO1P123MB1203;BCL:0;PCL:0;RULEID:;SRVR:LO1P123MB1203;

x-forefront-prvs: 0641678E68

x-forefront-antispam-report: SFV:NSPM;SFS:(10009020)(396003)(39830400003)(376002)(346002)(366004)(39380400002)(47530400004)(189003)(199004)(61484003)(6306002)(3846002)(236005)(3480700004)(55016002)(99286004)(7696005)(9686003)(76176011)(8936002)(33656002)(446003)(476003)(11346002)(81156014)(81166006)(8676002)(54896002)(7736002)(102836004)(53546011)(59450400001)(86362001)(6506007)(486006)(26005)(186003)(74316002)(52230400001)(229853002)(606006)(7116003)(5660300001)(54556002)(97736004)(68736007)(106356001)(733005)(6436002)(66066001)(105586002)(93886005)(14454004)(316002)(6916009)(3280700002)(25786009)(3660700001)(2900100001)(790700001)(6116002)(99936001)(478600001)(5250100002)(53936002)(45080400002)(6246003)(74482002)(2906002);DIR:OUT;SFP:1101;SCL:1;SRVR:LO1P123MB1203;H:LOXP123MB1286.GBRP123.PROD.OUTLOOK.COM;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;

received-spf: None (protection.outlook.com: simplyitgb.co.uk does not

designate permitted sender hosts)

x-microsoft-antispam-message-info: 3L5xzrHr77W+KFLkkqtMCNSXcrTQ7mu0onQDv9k6b9tTmzfY8Tr9hY0dZQwiJKGXwumSF3LmtDWcClBrunyL6WDhyysL/YFMPCFV0Sq+abgj4Biq5mvSNyt6NARFdnmgOfttVEqhUi6dg5lQGjEOMeRYv1cvVrKNwTLipUujDmkeCTWOYfrX0pkZ1Zz2/mqUk8+kDfLUlw06gbxUb81EfGagiGjjdMrxgJS2w15iTyRhxqSeiF/UZQ/HQOek9cooWFe2KmBUT21n2u3OP9IwFGsdq3k43Ach/A9aeON0gu/DQDsHyLKB8V0kGoXx73lIWG01nOvbDnKaVPI5xD6t3qB+FMh1AmJ/+9cVXWLZ+/xSm2oAvc0bcbpPJh07TGWkQFhw4qJoqMB5H31VBIgF30usedNG3BxV1P4y0hbHre4=

spamdiagnosticoutput: 1:99

spamdiagnosticmetadata: NSPM

Content-Type: multipart/related;

boundary="_006_LOXP123MB12864A70538E3B38D6C1CF1BCEBE0LOXP123MB1286GBRP_";

type="multipart/alternative"

MIME-Version: 1.0

X-OriginatorOrg: simplyitgb.co.uk

X-MS-Exchange-CrossTenant-Network-Message-Id: e64d5454-630e-45e0-2483-08d59ebc53fc

X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Apr 2018 08:23:24.1929

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: b931b056-a2a3-4d16-8d81-42e5471cabb3

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO1P123MB1203

[pantscat]

"454 4.7.5 Certificate validation failure" is the error.

 

Looks like it's an issue with the cert on your Exchange box. Are you using a self-signed cert?

[Domino]

454 4.7.5 Certificate validation failure

 

Have you got a valid cert for the connector, for the name the connector responds as? SSL/TLS Certificate Installation Instructions - Microsoft Exchange 2010 — Technote Article — Entrust

[Domino]

of course if you're using Office 365, you could also set that to act your mail gateway.

 

Add and verify your domain

ensure users are synced with mail addresses

setup connectors to and from your server

change the public MX to be the 365 generated address

[Jawloms]

of course if you're using Office 365, you could also set that to act your mail gateway.

 

Add and verify your domain

ensure users are synced with mail addresses

setup connectors to and from your server

change the public MX to be the 365 generated address

 

Love to, but since moving to Schoolsbroadband, my AD Sync has stopped working too and they don't seem able to help me with that either.

 

Stuart

[Jawloms]

Have you got a valid cert for the connector, for the name the connector responds as? SSL/TLS Certificate Installation Instructions - Microsoft Exchange 2010 — Technote Article — Entrust

 

It looks like I have a cert for mail.debenhamhighschool.suffolk.sch.uk in there. Do I need one for debenhamhigh.co.uk? Once again, all our outgoing email addresses are @DebEnhamhigh.co.uk, but the mail server presents itself for OWA, mail clients on mobiledevices etc as mail.debenhamhighschool.suffolk.sch.uk.

Edited April 19, 2018 by Jawloms

[RobD]

Its definitely related to your certificates, check your server names that it matches the wildcard: *debenhamhighschool.suffolk.sch.uk

 

Also a banner issue:

 

Reverse DNS does not match SMTP Banner

fix should be here:

https://blog.mxtoolbox.com/2010/03/22/what-does-the-warning-reverse-dns-does-not-match-smtp-banner-mean-smtp-diagnostic-tool/

[RobD]

It looks like I have a cert for mail.debenhamhighschool.suffolk.sch.uk in there. Do I need one for debenhamhigh.co.uk? Once again, all our outgoing email addresses are @DebEnhamhigh.co.uk, but the mail server presents itself for OWA, mail clients on mobiledevices etc as mail.debenhamhighschool.suffolk.sch.uk.

 

It'll be a mismatch between debenhamhigh.co.uk and debenhamhighschool.suffolk.sch.uk. Do you have a wildcard for debenhamhigh.co.uk you can apply??

[Jawloms]

Not that I know of, but all set up before I started here. I didn't need this when I was with the LA and they routed all my email? Would that mean they would have the cert I need on installed something, or does it work differently if you're routing someone elses mail? Presumably if I don't have the cert, I need to purchase one for a few hundred £s?

 

Stuart

[RobD]

If you don't enforce TLS then the other end wont lookup a cert but it does mean all your mail would send unauthenticated.

 

You could test the TLS with your current cert but sending mail as @DebEnhamhighschool.suffolk.sch.uk to see if mail flows?