Lets talk about my domain, for privacy sake, lets call it xyz.com
MX records:
MX 10 points to public IP address 1 using Internet Provider 1 (This is NAT'ed with a DMZ based host1) (this is a Barracuda SPAM appliance)
MX 20 points to public IP address 2 using Internet Provider 2 (This is NAT'ed with a DMZ based host2) (this is a windows 2003 IIS SMTP)
The Barracuda usually gets all the emails
- then checks the AD by querying AD servers located in the private network for user validation
- then it checks for VIRUS/SPAM
The Windows 2003 box does ocassionally get some email
- it simply accepts emails for the domain xyz.com and forwards to a smart host (which is nothing but the barracuda box)
- The barracuda then does the user validation, virus and spam check.
Barracuda then sends the email to an exchange 2010 (all roles on 1 server) which is located in the private network.
When Exchange wants to send an outbound email to the Internet, it simply sends to a smarthost which is the same barracuda box.
Barracuda then checks for SPAM/VIRUS for that Internet bound email and sends it out.
Issue:
Recently we enabled TLS on the barracuda.
In doing so 2-3 things happened:
1. This allows the barracuda to accept emails from the Internet using TLS (if requested by sender).
If the sender does not want to use TLS to send, barracuda still accepts the email in clear text.
2. Now the barracuda also uses TLS to send emails to our exchange.
3. Exchange also now uses TLS to send emails to barracuda
4. Barracuda now tries sends emails to Internet using TLS, if available, or else uses clear text.
As you can see its opportunistic TLS.
If its there it will use it.
However the Windows IIS box does not support TLS.
Even if I get a certificate and enable TLS, TLS is forced on all connections.
I dont want TLS to be forced, because I will miss a lot of emails.
Many of our clients may not be able to send emails.
I want the Windows IIS box to work like how the barracuda does, in matters of TLS.
Can I remove that Windows 2003 box and replace it with a Windows 2008 with Exchange 2010 edge server?
I dont want the edge server to talk to my AD for user validation.
I dont want the edge server to do any SPAM or VIRUS check (i am okay if it forces me to use that bit)
All I want from that edge server is to
- accept emails from Internet for my domain
- allow inbound and outbound TLS (NO FORCING)
- and send that incoming email straight to the barracuda, which will do user validation and spam/virus checks.
As you can see i just want it as a better IIS SMTP replacement?
Can this be done?
Can someone guide me?
It will help me a lot.
Thanks in advance!
MX records:
MX 10 points to public IP address 1 using Internet Provider 1 (This is NAT'ed with a DMZ based host1) (this is a Barracuda SPAM appliance)
MX 20 points to public IP address 2 using Internet Provider 2 (This is NAT'ed with a DMZ based host2) (this is a windows 2003 IIS SMTP)
The Barracuda usually gets all the emails
- then checks the AD by querying AD servers located in the private network for user validation
- then it checks for VIRUS/SPAM
The Windows 2003 box does ocassionally get some email
- it simply accepts emails for the domain xyz.com and forwards to a smart host (which is nothing but the barracuda box)
- The barracuda then does the user validation, virus and spam check.
Barracuda then sends the email to an exchange 2010 (all roles on 1 server) which is located in the private network.
When Exchange wants to send an outbound email to the Internet, it simply sends to a smarthost which is the same barracuda box.
Barracuda then checks for SPAM/VIRUS for that Internet bound email and sends it out.
Issue:
Recently we enabled TLS on the barracuda.
In doing so 2-3 things happened:
1. This allows the barracuda to accept emails from the Internet using TLS (if requested by sender).
If the sender does not want to use TLS to send, barracuda still accepts the email in clear text.
2. Now the barracuda also uses TLS to send emails to our exchange.
3. Exchange also now uses TLS to send emails to barracuda
4. Barracuda now tries sends emails to Internet using TLS, if available, or else uses clear text.
As you can see its opportunistic TLS.
If its there it will use it.
However the Windows IIS box does not support TLS.
Even if I get a certificate and enable TLS, TLS is forced on all connections.
I dont want TLS to be forced, because I will miss a lot of emails.
Many of our clients may not be able to send emails.
I want the Windows IIS box to work like how the barracuda does, in matters of TLS.
Can I remove that Windows 2003 box and replace it with a Windows 2008 with Exchange 2010 edge server?
I dont want the edge server to talk to my AD for user validation.
I dont want the edge server to do any SPAM or VIRUS check (i am okay if it forces me to use that bit)
All I want from that edge server is to
- accept emails from Internet for my domain
- allow inbound and outbound TLS (NO FORCING)
- and send that incoming email straight to the barracuda, which will do user validation and spam/virus checks.
As you can see i just want it as a better IIS SMTP replacement?
Can this be done?
Can someone guide me?
It will help me a lot.
Thanks in advance!
konkani