Configure Exchange to Send Outbound Email via Symantec Email Security.Cloud Service

Products

• Email Security.cloud

Issue/Introduction

Steps on how to configure the Exchange server to route Outbound emails via Symantec Email Cloud. 

Environment

Email Security cloud

Microsoft Exchange

Microsoft 365 Services

 

Cause

Setting connectors is necessary to ensure the correct email transport between Microsoft services and Email security cloud.

Resolution

Configuring Exchange 2019

Use the EAC to create an internet Send connector

1. In the EAC, navigate to Mail flow > Send connectors, and then click Add . This starts the New Send connector wizard.

2. On the first page, enter the following information:

   • Name: Enter a descriptive name for the Send connector (for example, To internet).

   • Type: Select Internet.

   When you're finished, click Next.

3. On the next page, verify that MX record associated with recipient domain is selected. This means the connector uses DNS on the internet to route mail, as opposed to routing all outbound mail to a smart host. For information about creating a Send connector that uses smart host routing, see Create a Send connector to route outbound mail through a smart host.

   When you're finished, click Next.

4. On the next page, enter the following information:

   • In the Address space section, click Add . In the Add domain dialog box that appears, in Fully Qualified Domain Name (FQDN), enter an asterisk (*), and then click Save. This value indicates that the Send connector applies to messages addressed to all external domains.

   • The Scoped send connector setting is important if your organization has Exchange servers installed in multiple Active Directory sites:

     • If you don't select Scoped send connector, the connector is usable by all transport servers (Exchange 2013 or later Mailbox servers and Exchange 2010 Hub Transport servers) in the entire Active Directory forest. This is the default value.

     • If you select Scoped send connector, the connector is only usable by other transport servers in the same Active Directory site.

   When you're finished, click Next.

5. On the next page, in the Source server section, click Add . In the Select a Server dialog box that appears, select one or more Mailbox servers that you want to use to send mail to the internet. If you have multiple Mailbox servers in your environment, select the ones that can route mail to the internet. If you have only one Mailbox server, select that one. After you've selected at least one Mailbox server, click Add, click OK, and then click Finish.

After you create the Send connector, it appears in the Send connector list. To configure the Send connector to proxy outbound mail through the Front End Transport service, see Configure Send connectors to proxy outbound mail.

 

Configuring Exchange 2016

Use the EAC to create a Send connector that uses smart host routing

1. In the EAC, navigate to Mail flow > Send connectors, and then click Add . This starts the New Send connector wizard.

2. On the first page, enter the following information:

   • Name   Enter a descriptive name for the Send connector, for example, Smart host to Internet.

   • Type   Select a descriptive value. For example, Internet or Custom.

   When you are finished, click Next.

3. On the next page, select Route mail through smart hosts, and then click Add . In the Add smart host dialog box that appears, identify the smart host by using the following value:

   • Fully qualified domain name (FQDN)   For example, securitydevice01.contoso.com. Note that the Exchange source servers for the Send connector must be able to resolve the smart host in DNS by using this FQDN.

   When you are finished, click Save.

4. You can enter multiple smart hosts by repeating Step 3. When you are finished, click Next.

5. On the next page, in the Route mail through smart hosts section, select the authentication method that's required by the smart host. Valid values are:

    

   Authentication mechanism	Description
   None	No authentication. For example, when access to the smart host is restricted by the source IP address.
   Basic authentication	Basic authentication. Requires a user name and password. The user name and password are sent in clear text.
   Offer basic authentication only after starting TLS	Basic authentication that's encrypted with TLS. This requires a server certificate on the smart host that contains the exact FQDN of the smart host that's defined on the Send connector.
   Exchange Server authentication	Generic Security Services application programming interface (GSSAPI) and Mutual GSSAPI authentication.
   Externally secured	The connection is presumed to be secured by using a security mechanism that's external to Exchange. The connection may be an Internet Protocol security (IPsec) association or a virtual private network (VPN). Alternatively, the servers may reside in a trusted, physically controlled network.

   When you are finished, click Next.

6. On the next page, in the Address space section, click Add . In the Add domain dialog box that appears, enter the following information:

   • Type   Verify SMTP is entered.

   • Fully Qualified Domain Name (FQDN)   Enter an asterisk (*) to indicate the Send connector applies to messages addressed to all external domains. Alternatively, you can enter a specific external domain (for example, contoso.com), or a domain and all subdomains (for example, *.contoso.com).

   • Cost   Verify 1 is entered. A lower value indicates a more preferred route for the domains you specified.

   When you are finished, click Save.

7. Back on the previous page, the Scoped send connector setting is important if your organization has Exchange servers installed in multiple Active Directory sites:

   • If you don't select Scoped send connector, the connector is usable by all transport servers (Exchange 2016 Mailbox servers, Exchange 2013 Mailbox servers, and Exchange 2010 Hub Transport servers) in the entire Active Directory forest. This is the default value.

   • If you select Scoped send connector, the connector is only usable by other transport servers in the same Active Directory site.

   When you are finished, click Next.

8. On the next page, in the Source server section, click Add . In the Select a Server dialog box that appears, select one or more Mailbox servers that you want to use to send outbound mail to the smart host. If you have multiple Mailbox servers in your environment, select the ones that can route mail to the smart host. If you have only one Mailbox server, select that one. After you've selected at least one Mailbox server, click Add, click OK, and then click Finish.

After you create the Send connector, it appears in the Send connector list.

How do you know this worked?

To verify that you have successfully created a Send connector to route outbound email through a smart host, send a message from a user in your organization to an external domain that's serviced by the Send connector.