Configure anonymous SMTP relay in Exchange Server

Most of the time, you get asked if it’s possible to send an email to external recipients from an application or server in the organization. Well, it is possible if we configure a dedicated anonymous SMTP relay Exchange receive connector. Now how do we set it up? In this article, we will create an anonymous Exchange SMTP relay connector.

Internal SMTP relay

To relay email internal, you don’t have to configure an SMTP receive connector. It’s already set up with the default Exchange Server configuration. For example, let’s say you have an application and want to send an email to internal mailboxes. You set up a noreply@company.com email address, and it will send the email successfully to the internal mailbox users.

Create new receive connector

We have to create a dedicated receive connector for SMTP relay in Exchange Server. We can create the receive connector in:

• Exchange Admin Center
• Exchange Management Shell (PowerShell)

Note: Create the same receive connector on all Exchange Servers.

Create receive connector in Exchange Admin Center

Sign in to Exchange Admin Center. Click in the feature pane on mail flow and follow with receive connectors in the tabs. Select the Exchange Server if you have multiple Exchange Servers. Click on + in the toolbar to create a new receive connector.

Fill in a name for the receive connector. For example, SMTP relay. Select the role Frontend Transport and type Custom. Click Next.

Keep the network adapter bindings as default and click Next.

Add the server or servers that will use the SMTP relay in the Remote network settings. You can make use of IP addresses and IP ranges. In our example, IP address 192.168.1.60 is an application server that sends emails to internal and external recipients. Click Finish.

Important: Remove the default IP range 0.0.0.0-255.255.255.255.

Note: Do not add the Exchange Servers in the SMTP relay receive connector. It will cause issues with communication between Exchange Servers, and mail flow will not work correctly. Read more in the article Exchange Server internal mail flow not working.

The SMTP relay receive connector is successfully created.

Create receive connector with PowerShell

Do you want to create an SMTP relay receive connector with PowerShell? Run Exchange Management Shell as administrator. Make use of the New-ReceiveConnector cmdlet.

[PS] C:\>New-ReceiveConnector -Server "EX01-2016" -Name "SMTP relay" -TransportRole FrontendTransport -Custom -Bindings 0.0.0.0:25 -RemoteIpRanges 192.168.1.60

Identity             Bindings     Enabled
--------             --------     -------
EX01-2016\SMTP relay {0.0.0.0:25} True

Configure anonymous permissions

Run both the commands to grant the minimum required permissions to allow anonymous relay.

[PS] C:\>Set-ReceiveConnector "EX01-2016\SMTP relay" -PermissionGroups AnonymousUsers


[PS] C:\>Get-ReceiveConnector "EX01-2016\SMTP relay" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "Ms-Exch-SMTP-Accept-Any-Recipient"

Identity             User                 Deny  Inherited
--------             ----                 ----  ---------
EX01-2016\SMTP relay NT AUTHORITY\ANON... False False

Create SMTP relay DNS record

In the internal DNS, create an A record and point it to the load balancer or the Exchange Server(s). In my example, the load balancer.

Note: Point internal devices or applications to a DNS record instead of an IP address. It’s quicker to change one entry in DNS than to change an IP on every device and application.

Ping the FQDN, and it needs to resolve to the IP address. If it doesn’t, run ipconfig /flushdns and try again. If that doesn’t work, give it some time or troubleshoot further.

C:\>ping relay.exoip.com

Pinging relay.exoip.com [192.168.1.54] with 32 bytes of data:
Reply from 192.168.1.54: bytes=32 time<1ms TTL=64
Reply from 192.168.1.54: bytes=32 time<1ms TTL=64
Reply from 192.168.1.54: bytes=32 time<1ms TTL=64
Reply from 192.168.1.54: bytes=32 time<1ms TTL=64

Ping statistics for 192.168.1.54:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

Test anonymous SMTP relay

Test that the anonymous SMTP relay is set up correctly and that email relays through Exchange Server successfully. An excellent way to test Exchange anonymous SMTP relay is with the Send-Email.ps1 PowerShell script.

Run PowerShell as administrator. Copy the below script or download the Send-Email.ps1 PowerShell script. Before you run the script change the fields:

• To
• From
• SmtpServer

$EmailMessage = @{
    To         = "info@alitajran.com"
    From       = "application@exoip.com"
    Subject    = "Test email"
    Body       = "Test email sent using Exchange SMTP relay"
    SmtpServer = "relay.exoip.com"
    Port       = "25"
}

Send-MailMessage @EmailMessage

The output should not give you an error, and the email will arrive in the inbox you added in the To field.

Important: Do not run the Send-Email.ps1 PowerShell script on the Exchange Server, as it will result in an error.

Running the Send-Email.ps1 PowerShell script on the Exchange Server will result in the below error. Run the script only on the systems that are added to the SMTP relay receive connector.

Send-MailMessage : Mailbox unavailable. The server response was: 5.7.54 SMTP; Unable to relay recipient in non-accepted domain
At line:10 char:1
+ Send-MailMessage @EmailMessage
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.Mail.SmtpClient:SmtpClient) [Send-MailMessage], SmtpFailedRecipientException
    + FullyQualifiedErrorId : SmtpException,Microsoft.PowerShell.Commands.SendMailMessage

Other articles that you may be interested in:

• Copy receive connector to another Exchange Server
• Import remote IP addresses to Exchange receive connector
• Export remote IP addresses from Exchange receive connector

Conclusion

You learned how to configure an anonymous SMTP relay in Exchange Server. Create a dedicated receive connector and add the IP addresses or IP ranges that need to relay through the Exchange Server.

Did you enjoy this article? You may also like Send Out of Office reply every day with PowerShell. Don’t forget to follow us and share this article.