Copyright: Microsoft SMTP Service Help © 1999 Microsoft Corporation. All rights reserved. Other product and company names mentioned herein may be the trademarks of their respective owners.
Citation: Microsoft SMTP Service Help © 1999 Microsoft Corporation. All rights reserved. Other product and company names mentioned herein may be the trademarks of their respective owners.


General

Use the General tab to name the SMTP virtual server, identify the IP address, and set the connection type and limits. By default, the SMTP virtual server can respond to connection requests for all IP addresses configured on the computer.

  Name

  IP address

  Advanced

  Connection

  Enable logging

  Active log format


Name

Type the name of the SMTP virtual server. You can change the default name, but you cannot delete the default virtual server unless you first create another one.


IP address

The SMTP virtual server can respond to connection requests for all IP addresses configured on the computer.


Advanced

Clicking this button opens the Advanced window, which allows you to assign multiple IP addresses for this SMTP virtual server.


Connection

Click Connection to configure incoming and outgoing connections on the SMTP virtual server.


Enable logging

You can use logging to track commands the SMTP virtual server receives from SMTP clients over the network. You can choose one of the four logging formats Microsoft SMTP Service uses to record information by selecting a format from the list.


Active log format

You can choose one of four logging formats to track message transactions. The Microsoft Internet Information Services (IIS) Log File Format is a fixed ASCII format. W3C Extended Log File Format, the default option, is an ASCII form and can be customized, allowing you to choose the items you want to track. The National Center for Supercomputing Applications (NCSA) Common Log File Format is a fixed ASCII format. ODBC logging format uses an ODBC-compliant database to store logged data for a fixed set of data fields.


Advanced

Use this option to add, remove, or edit IP addresses and TCP port numbers for this SMTP virtual server. Each virtual server is identified by its IP address/TCP port combination.

You can define additional IP addresses to which this SMTP virtual server responds. Users can connect to the SMTP virtual server using any of the defined IP addresses.

  Configure multiple identities for this virtual server

  Add

  Edit

  Remove


Multiple identities for this SMTP virtual server
Configure multiple identities for this virtual server

Lists each IP address assigned to this SMTP virtual server, as well as the TCP port of each address. Users can connect to the SMTP virtual server using any of the IP addresses listed.


Add

Choose Add to open the Identification window, to add a new IP address and select a TCP port number for it on this SMTP virtual server.


Edit

Choose Edit to open the Identification window, in order to modify the TCP port number of the IP address you have selected.


Remove

Choose Remove to delete the IP address you have selected.


Advanced Multiple SMTP Virtual Server Configuration
Identification

Enter the new IP address and TCP port numbers for this SMTP virtual server. Port 25, the SMTP standard, is recommended for the TCP port. More than one SMTP virtual server can use port 25 provided they have different IP addresses.

  IP address

  TCP port


IP address

Lists the IP addresses that are used by this SMTP virtual server. Select an IP address that is defined on the computer running Microsoft Windows 2000 where Microsoft SMTP Service is located. You can configure multiple IP addresses from the Network Control Panel application.


TCP port

Type the TCP port number on which Microsoft SMTP Service is running. The default port is 25. SMTP virtual servers are identified by their IP address/TCP port number combination, so more than one SMTP virtual server can use the same TCP port, provided they are assigned different IP addresses. If you assign an IP/TCP combination to an SMTP virtual server that is already in use, that virtual server will not start. For a new port number to take effect, you must restart your computer.


Connections

Use Connections window to configure incoming and outgoing connections on this SMTP virtual server.

  Limit connections to

  Time-out (minutes)

  Limit connections per domain

  TCP port


Limit connections to
Limit number of connections

For incoming connections, this setting specifies the maximum number of concurrent connections there can be on this SMTP virtual server. The default is no limit, but when you select the check box the default limit is 1000. The minimum value is 1 connection.

For outgoing connections, this setting specifies the total number of outbound connections to all remote domains that can exist at one time. The check box is selected by default and the default limit is 1000. The minimum value is 1 connection.

For both incoming and outgoing connections, the check box must be selected for the limits to be activated.


Time-out (minutes)

If a connection is inactive for a designated number of minutes, Microsoft SMTP Service closes it. You can specify this time period. The default is 10 minutes for both incoming and outgoing connections.


Limit connections per domain to
Limit number of connections per domain to

This setting limits the number of outgoing connections to any single remote domain. The default is 100. The value should be less than or equal to the value you set for Limit connections to under Outgoing connections.


TCP port

This designates the TCP port used for outgoing transmissions. The default is port 25, which is the SMTP standard TCP port.


Access

Use the Access tab to configure client access to the SMTP virtual server and to establish transmission security. With Access control, you can configure Microsoft SMTP Service to allow anonymous access or to prompt users for a user name and password. Secure communication enables you to set security for the virtual server once access has been granted, and Connection control allows you to grant or deny use of the virtual server to specific users or groups. To prevent processing of unwanted mail, use Relay restrictions to block relay access to the virtual server.

  Authentication

  Certificate

  Communication

  Connection

  Relay


Access control

You can choose one or more authentication methods. Click Authentication to open the Authentication dialog box and view the authentication options.


Secure communication

To use TLS encryption, you must create key pairs and configure key certificates. Clients can then use TLS to submit encrypted messages to Microsoft SMTP Service, which Microsoft SMTP Service can then decrypt. Click Certificate to open the Web Server Certificate Wizard.


Communication

This feature ensures that data is encrypted by requiring the client to use Transmission Layer Security (TLS) for connections to Microsoft SMTP Service. Click Communication to open the Security dialog box and set the encryption level.


Connection control

You have several options for restricting access to newsgroups. Choose Connection to view restriction options.

By default, the SMTP virtual server is accessible from all IP addresses. However, you can grant or deny access to specific IP addresses, while allowing or denying access for a larger group. You can do this by specifying a single IP address, a group of addresses using a subnet mask, or a domain name.


Relay restrictions

Microsoft SMTP Service blocks computers from relaying unwanted mail through the virtual server. By default, all computers are blocked from relay access except those that have met authentication requirements. You can enable relay access to the virtual server for specific computers, for a group of addresses using a subnet mask, or for a domain.  Choose Relay to view relay restriction options.

Note that the SMTP virtual server relay access setting can be overridden for a specific remote domain.


Authentication Methods
Authentication

Select one or more authentication methods. Microsoft SMTP Service verifies the user's identity and grants access to the requested content as determined by your Windows access control list (ACL) settings.

  Allow anonymous

  Basic authentication

  Require TLS encryption

  Default domain

  Windows security package


Allow anonymous

Select this option to allow any client access to the contents of this directory. No user name or password is required.  By selecting this option and clearing the remaining two, you can disable authentication for the virtual server.


Basic authentication

Select this option to enable Basic (clear-text) password authentication. For basic authentication, an account name and password is transmitted in clear text. You specify a Windows 2000 domain that is appended to the account name for authentication.


Require TLS encryption

Select this check box to require the encryption of incoming messages using Transport Layer Security (TLS).


Default domain

Designate a Windows 2000 Server domain to be used as the default domain for basic authentication for incoming messages. This domain name is appended to the account name.


Windows security package

Select this option to enable the standard Security Package security mechanism that is provided with Microsoft Windows 2000. This security feature makes it possible for businesses to provide secure logon services for their customers. Virtual servers that already use Windows Security Package in an internal system can benefit by using a single, common security mechanism.

Windows Security Package authentication uses a cryptographic technique for authenticating users and does not require the user to transmit actual passwords across the network. For more information, see the Microsoft Internet Information Services documentation.

Note  Using Windows Security Package authentication requires a mail client that supports this authentication method. Microsoft Outlook Express supports Windows Security Package authentication.


Security

Key pairs consist of a number of bits that indicate the key's security level. You can strengthen security by increasing the encryption level from the default key strength of 40 bits to 128 bits. The larger the number of bits, the more difficult the item is to decrypt. Users attempting to secure access must use the same encryption level that you set. If you configure an SMTP virtual server for 128-bit security, all SMTP clients configured with lower security will be refused.

  Require secure channel

  Require 128-bit encryption


Require secure channel

You can ensure that incoming data is encrypted by requiring the use of Transport Layer Security (TLS) between servers.

To use TLS encryption, you must create key pairs and configure key certificates. Client computers can then use TLS to submit encrypted messages to Microsoft SMTP Service, which Microsoft SMTP Service can then decrypt.

Key pairs consist of a number of bits that indicate the key's security level. You can strengthen security by increasing the encryption level from the default key strength of 40 bits to 128 bits. The larger the number of bits, the more difficult the item is to decrypt. Users attempting to secure access must use the same encryption level that you set. If an SMTP client is only set for 40-bit encryption, all messages will be refused by a 128-bit encrypted server.

Due to export restrictions, the 128-bit key strength encryption feature is available only in the United States and Canada.


Require 128-bit encryption

Key pairs consist of a number of bits that indicate the key's security level. You can strengthen security by increasing the encryption level from the default key strength of 40 bits to 128 bits. The larger the number of bits, the more difficult the item is to decrypt. Users attempting to secure access must use the same encryption level that you set. If an SMTP client is only set for 40-bit encryption, all messages will be refused by a 128-bit encrypted server.

Due to export restrictions, the 128-bit key strength encryption feature is available only in the United States and Canada.


Connection

Use these options to limit access to the SMTP virtual server by client IP address or domain name.

You can grant access to all computers and then make exceptions to this rule by denying access to specific computers. Likewise, if you deny access to all computers, you still can grant access to specific computers.

  Only the list below

  All except the list below

  Access

  IP Address (Mask) / Domain Name

  Add

  Remove


Only the list below

Select the Only the list below option to deny access to all IP addresses except the specific addresses and domains you list.


All except the list below

Select the All except the list below option to grant access to all IP addresses except the specific addresses and domains you list.


All except the list below
Access

Will display either Granted or Denied beside an address or domain in your list.


IP Address (Mask) / Domain Name

Displays the IP address or addresses and the any domain names you have chosen to grant or deny access to.


Add

Choose Add to open the Computer dialog box and grant or deny access to a specific IP address or domain name.


Remove

Choose Remove to remove the IP address or domain name that you have selected from the list.


Computer

Select the type of address you want to add to your list, and then enter the required information. Use Single Computer to select a single computer by IP address. Choose DNS Lookup to look up an IP address.

Use Group of Computers to select a group of computers within a subnet.

Use Domain to select all of the computers in a domain by domain name. (This option adds processing overhead and might reduce Microsoft SMTP Service performance.)

  IP address

  DNS Lookup

  Subnet address

  Subnet mask

 Name


IP address

The IP address of a single computer that is being added to the list. Choose DNS Lookup to look up an IP address.


DNS Lookup

Use this option to look up the IP address of a computer by its DNS name.


Subnet address

The base IP address for a group of computers that is being added to the list. A subnet mask is required.


Subnet mask

The subnet mask that specifies the range of IP addresses for a group of computers. See Microsoft Windows 2000 Server Networking Guide for more information on subnet masks.


Name

The domain name of a group of computers that is being added to the list.


Relay Restrictions

Use these options to limit by client IP address or domain name those computers allowed to relay mail through this virtual server.

You can grant relaying to all computers and then make exceptions to this rule by denying relay access to specific computers. Likewise, if you deny relay access to all computers, you still can grant relay access to specific computers.

Note that if your virtual server is on the Internet, relaying is not recommended or the virtual server could end up propagating unsolicited commercial e-mail.

  Only the list below

  All except the list below

  Access

  IP Address (Mask) / Domain Name

  Add

  Remove

  Allow all computers which successfully authenticate to relay, regardless of the list above


Only the list below

Select the Only the list below option to deny relaying to all IP addresses except the specific addresses and domains you list.


All except the list below

Select the All except the list below option to grant relaying permission to all IP addresses except the specific addresses and domains you list.


All except the list below
Access

Will display either Granted or Denied beside an address or domain in your list.


IP Address (Mask) / Domain Name

Displays the IP address or addresses and the any domain names you have chosen to grant or deny relaying privileges to.


Add

Choose Add to open the Computer dialog box and grant or deny relaying to a specific IP address or domain name.


Remove

Choose Remove to remove the IP address or domain name that you have selected from the list.


Allow all computers which successfully authenticate to relay, regardless of the list above

This check box is selected by default, and allows relaying by anyone who is granted access to this virtual server with their authentication credentials.


Messages

Once a connection has been opened and the receiving server has acknowledged that it is ready to receive data, messages can be transmitted for delivery. You can use the Messages tab to determine transmission requirements and limits.

  Limit message size to (KB)

  Limit session size to (KB)

  Limit number of messages per connection to

  Limit number of recipients per message to

  Send a copy of non-delivery report to

  Badmail directory


Limit message size to (KB)

This is what Microsoft SMTP Service will advertise, in kilobytes, as the maximum message size this SMTP virtual server will accept. If a mail client sends a message that exceeds the limit, the client will get an error. If a remote server supports EHLO, it will detect the advertised maximum message size value when it connects to the SMTP virtual server and won't even attempt to deliver a message that exceeds the limit. Instead it will simply NDR the sender of the message. A remote server that doesn't support EHLO will try to send a message that exceeds the size limit, but will still end up sending an NDR to the sender when the message doesn't go through.

The default is 2048 KB. The minimum value is 1KB. To have no limit, clear the check box.


Limit session size to (KB)

This is the maximum amount of data, in kilobytes, accepted during the total connection. It is the sum of all messages sent during the connection (applying to the message body only).

Type a value larger than the Limit message size to (KB). This maximum should be set carefully, because the connecting message transfer agent (MTA) is likely to resubmit the message repeatedly. The default size is 10240 KB. This value should be greater than or equal to the value entered for Limit message size to (KB). To have no limit, clear the check box.


Limit number of messages per connection to

When the check box is selected, this option enables you to limit the number of messages sent in a single connection. The default is 20. This feature also provides a method to increase system performance by using multiple connections to deliver messages to a remote domain. Consequently, once the set limit is reached, a new connection is automatically opened and the transmission continues until all messages are delivered. See Limiting the number of messages per connection in your Microsoft SMTP Service online documentation for more information.


Limit number of recipients per message to

This setting limits the maximum number of recipients for a single message. The default is 100, which is the minimum required number specified in Request for Comments (RFC) 821. To disable this feature and have no limit, clear the check box.

Some clients return messages with a non-delivery report (NDR) once an error message is received indicating that the maximum number of recipients has been exceeded. A server running Microsoft SMTP Service does not return messages with an NDR in this instance. It opens a new connection immediately and processes the remaining recipients. For example, if the recipient limit is set to 100 and a message with 105 recipients is being transmitted, the first 100 are delivered in one connection after receipt of the error message. Then a new connection is opened and the message is processed for the remaining five recipients.


Send a copy of Non-Delivery report to

When a message is undeliverable, it is returned to the sender with a non-delivery report (NDR). You can designate that copies of the NDR are sent to a specific SMTP mailbox. Type an e-mail address for the mailbox.


Badmail directory

When a message is undeliverable, it is returned to the sender with a non-delivery report (NDR). You can designate that copies of the NDR are sent to a location of your choice.

All NDRs go through the same delivery process as other messages, including attempts to resend the message. If the NDR has reached the retry limit and cannot be delivered to the sender, a copy of the message is placed in the Badmail directory. Messages placed in the Badmail directory cannot be delivered or returned. Check the directory regularly and reconcile the messages, because a full directory may adversely affect Microsoft SMTP Service performance.


Delivery

Once a connection has been opened and the receiving server has acknowledged that it is ready to receive data, messages can be transmitted for delivery. Use the Delivery tab to set all delivery and routing options. This includes setting retry intervals for delivering messages, limiting the number of hops to servers during delivery, and identifying a masquerade domain name to display in the From line instead of the sender's original domain name.

  First retry interval (minutes)

  Second retry interval (minutes)

  Third retry interval (minutes)

  Subsequent retry interval (minutes)

  Delay notification

  Expiration timeout

  Outbound Security

  Advanced


First retry interval (minutes)

Type the interval (in minutes) Microsoft SMTP Service must wait before issuing the first delivery status notification.  The valid range is 1 through 9999 minutes, and the default interval is 15 minutes.


Second retry interval (minutes)

Type the interval (in minutes) Microsoft SMTP Service must wait before issuing the second delivery status notification.  The valid range is 1 through 9999 minutes, and the default interval is 30 minutes.


Third retry interval (minutes)

Type the interval (in minutes) Microsoft SMTP Service must wait before issuing the third delivery status notification.  The valid range is 1 through 9999 minutes, and the default interval is 60 minutes.


Subsequent retry interval (minutes)

Type the interval (in minutes) Microsoft SMTP Service must wait before issuing subsequent delivery status notifications.  The valid range is 1 through 9999 minutes, and the default interval is 240 minutes.


Delay notification

To allow for network delays in both local and remote delivery, you can set a delay period to expire before sending the delivery notification. For both Outbound and Local, the minimum value is 1 minute, the default is 12 hours, and the maximum value is 9999 days. Use the drop-down menus beside each delay notification field to set the value in either minutes, hours, or days.


Expiration timeout

Type a value for messages that have not been delivered after all retries and delays have expired. For both Outbound and Local, the minimum value is 1 minute, the default is 2 days, and the maximum value is 9999 days. Use the drop-down menus beside each expiration timeout field to set the value in either minutes, hours, or days.


Outbound Security

You can configure the SMTP virtual server to provide the authentication credentials required by a receiving server. You can also require that sessions are encrypted using Transport Layer Security (TLS). Click Outbound Security to open the Outbound Security dialog box and view security options.


Advanced

Click Advanced to open the Advanced Delivery dialog box, where you can set additional delivery parameters on this SMTP virtual server.


Outbound Security

There are three types of authentication available - Anonymous, Basic (clear text), and Windows Security Package. Anonymous access, the default option, requires no authentication.  Note that the authentication and TLS encryption options set on the Delivery tab can be overridden for a specific remote domain, which can be done through the Remote Domain dialog box.

  Anonymous access

  Basic authentication

  Windows security package

  TLS encryption


Anonymous access

Use this option to disable authentication for outbound transmissions. This is the default option.


Basic authentication

With the Basic authentication option, the account name and password of the server you're connecting to is transmitted in clear text. This setting should match the receiving server's incoming authentication requirements.

A user name and password are required for this option. Click Browse to select a user.


Windows security package

Select this option to use Windows Security Package for authentication. This setting should match the receiving server's incoming authentication requirements.

A Windows account name and password are required for this option. Click Modify to select an account.


TLS encryption

Select this check box to require that all outgoing messages are encrypted using Transport Layer Security (TLS).


Advanced Delivery

Use the Advanced Delivery dialog box to set routing options on your SMTP virtual server.

  Maximum hop count

  Masquerade domain

  Fully-qualified domain name

  Smart host

  Attempt direct delivery before sending to smart host

  Perform reverse DNS lookup on incoming messages


Maximum hop count

When a message is delivered, it may be routed to a number of servers before reaching its final destination. You can designate how many servers the message is allowed to pass through. This is referred to as the hop count.

After the hop count is set, the SMTP server counts hops listed in the Received header lines of the message header. When the number of Received fields exceeds the maximum hop count setting, the message is returned to the sender with a non-delivery report (NDR). The default is 15 hops.


Masquerade domain

The masquerade domain name replaces the local domain name listing in Mail From lines in the protocol.


Fully-qualified domain name

There are two records that can be used to identify and verify a computer in a TCP/IP network. The mail exchanger (MX) record identifies the host and domain name associated with the computer. It uses the fully qualified domain name (FQDN) for the domain name. The address (A) record identifies the IP address for the computer. When both records are used, name resolution occurs faster.

For Microsoft SMTP Service to process MX records, an FQDN must be designated. An FQDN is used by DNS to identify the host server for a domain. The syntax is host.domain. For example, CompanyA.com may have several host servers, one of which is named Server01. The FQDN for the server would be Server01.CompanyA.com.

There are two options for specifying an FQDN. You can use the name specified on the Network Identification tab of the System Properties (in Control Panel), or you can specify a unique FQDN for the SMTP virtual server you are configuring.

At startup, the name designated on the Network Identification tab of the System Properties is automatically used for the FQDN. If you change the name (either manually or by joining a Windows 2000 domain), the new name is automatically used for the FQDN the next time the computer is started. No action is required to update the FQDN for the SMTP virtual server.

To override the automatic use of the computer and domain names on the Network Identification tab, change the FQDN on the Delivery tab. Microsoft SMTP Service can then use the designated name instead of the one specified on the Network Identification tab.

For more information on FQDNs, see your Windows 2000 Server documentation.


Smart host

You can route all outgoing messages for remote domains through a smart host instead of sending them directly to the domain. This allows you to route messages over a connection that may be more direct or less costly than other routes. The smart host is similar to the route domain option for remote domains. The difference is that once a smart host is designated, all outgoing messages are routed to that server. With a route domain, only messages for the remote domain are routed to a specific server.

If you set up a smart host, you can still designate a different route for a remote domain. The route domain setting overrides the smart host setting.

Type an FQDN or an IP address to identify the smart host. If you use an IP address, enclose it in brackets [ ] to increase system performance. Microsoft SMTP Service checks first for a name then an IP address. The brackets identify the value as an IP address, so the DNS lookup is bypassed.


Attempt direct delivery before sending to smart host

When this is selected, Microsoft SMTP Service attempts to deliver remote messages directly before forwarding them to the smart host server. The default is to send all remote messages to the smart host, not to attempt direct delivery.


Perform reverse DNS lookup on incoming messages

If you select this option, Microsoft SMTP Service will attempt to verify that the client's IP address matches the host/domain submitted by the client in the EHLO/HELO command. If the reverse DNS lookup is successful, the RECEIVED header will remain intact. If the verification is unsuccessful, "unverified" appears after the IP address in the RECEIVED header of the message.

Note Because this feature verifies addresses for all incoming messages, its use could affect Microsoft SMTP Service performance.


LDAP Routing

Use the LDAP Routing tab to specify the identity and properties of the directory services server used for this SMTP virtual server. The directory services store information about mail clients and their mailboxes. The SMTP virtual server uses Lightweight Directory Access Protocol (LDAP) to communicate with the directory services.

You can configure Microsoft SMTP Service so that it will consult an LDAP server to resolve senders and recipients. For example, you can use the Windows 2000 Active Directory as an LDAP server, and use Active Directory Users and Computers to create a group mailing list that is automatically expanded on the SMTP virtual server.

To activate LDAP Routing select the Enable LDAP routing check box. Then you can configure the following fields:

  Server

  Schema

  Binding

  Domain

  User name

  Password

  Base


Server

Type the name of the computer running the LDAP directory. The field is not applicable when you use the Exchange LDAP Service schema type, as the service will find a nearby server and use it automatically.


Schema

Select the type of directory service being used. The available types are:

•	Active Directory: select this to use the Windows 2000 Active Directory as the LDAP server. To manage mailboxes, use Active Directory Users and Computers.

•	Site Server Membership Directory: use this option when you have installed Microsoft LDAP Service as part of Microsoft Commercial Internet System 2.0 Mail and you are using it to manage mailboxes.

•	Exchange LDAP Service: select this option to use a Microsoft Site Server 3.0 or later LDAP server to manage mailboxes.


Binding

Select the binding type. The binding type specifies how the virtual server is authenticated by the directory service. The available types are:

•	Anonymous: no user name or password is sent to the directory service. This is the default binding type.

•	Plain text: the Account and Password values are sent to the directory service as unencrypted clear text.

•	Windows SSPI: the Account and Password values are encrypted before being sent to the directory service.

•	Service accounts: uses the account information of the user under which Microsfort SMTP Service is running. This is controlled by Component Services, under Administrative Tools.


Domain

Type the domain of the account you want to use to bind to the LDAP directory. This option applies if you select the Plain text or Windows SSPI binding types.


User name

Type the distinguished name (DN) of the account you want to use to bind to the LDAP directory. For example:

cn=user1,ou=users,o=company

This option applies if you select the Plain text or Windows SSPI binding types.


Password

Type the password used for logging on to the directory service. This option applies if you select the Plain text or Windows SSPI binding types.


Base

Type the distinguished name of a container in the directory service you're accessing. This setting specifies where you want Microsoft SMTP Service to start searching in the LDAP directory. The search will begin in the container and will continue to sub-containers if necessary.

A naming context may be necessary if the user accounts reside in a sub-container within the LDAP directory. Specifying a naming context may allow the LDAP directory to return results more quickly, and, in some cases, is necessary if there are multiple naming contexts on the LDAP server.


Security

Use the Security tab to add Microsoft Windows accounts and groups to the list of SMTP virtual server operators.

  Operators

  Add

  Remove


Operators

The display lists the user names and group names that you have specified as operators. Operators are allowed to access and make configurations to an SMTP virtual server. You can add still other names to this list by clicking Add.


Add

Opens the Select Users or Groups window, where you can choose Windows 2000 accounts to be operators on this SMTP virtual server.


Remove

Choose Remove to delete the operator you have selected.


Remote Domain General Properties

You can set unique delivery requirements for a specific remote domain by adding a domain and configuring it accordingly. For example, you can set a predetermined delivery route, require authentication, and require that TLS encryption be used on all connections to the domain. If the remote domain is not specifically configured, Microsoft SMTP Service will not perform any of these special operations when delivering to this domain. It will, however, complete a normal DNS lookup.

You can include an asterisk (*) in a remote domain name provided it is the first character listed and is followed by a period (.). Using the wildcard indicates that all inclusive domains for the domain you're creating use the same settings.

For remote domains you can set the following on the General tab:

  Allow incoming mail to be relayed to this domain

  Send HELO instead of EHLO

  Outbound Security

  Route domain


Allow incoming mail to be relayed to this domain

By default, Microsoft SMTP Service blocks computers from relaying unwanted mail to the remote domain. Select the Allow incoming mail to be relayed to this domain check box to override the relay restriction setting on the Access tab.


Send HELO instead of EHLO

ESMTP defines a method for extending SMTP whereby an SMTP server can inform an SMTP client of the extensions it supports. An SMTP client supporting ESMTP starts an SMTP session by issuing the EHLO command instead of the HELO command. A successful response issues a list of SMTP extensions the server supports.  If the server does not support ESMTP, and error is generated.

Click the Send HELO instead of EHLO check box to communicate only with HELO when sending to the remote domain.


Outbound Security

The authentication and TLS encryption options set on the Delivery tab can be overridden for a specific remote domain. This enables you to set the SMTP virtual server authentication level for most transmissions, while allowing exceptions for individual addresses handled by a particular remote domain. See Configuring authentication for a remote domain in your Microsoft SMTP Service documentation for more information. Click Outbound Security to set the authentication level for this remote domain.


Route domain

By default, the SMTP virtual server will attempt to deliver messages to this remote domain directly before forwarding them to a smart host. This is the Use DNS to route to this domain setting.

You can also specify a delivery path to a domain that may be faster and less expensive than a direct link. To do this, select Forward all mail to smart host, then type the name or IP address of the server through which you would like to route messages for this remote domain. Type an FQDN or an IP address to identify the smart host. If you use an IP address, enclose it in brackets [ ] to increase system performance. Microsoft SMTP Service checks first for a name then an IP address. The brackets identify the value as an IP address, so the DNS lookup is bypassed.

This route domain setting overrides the smart host setting for the entire virtual server (accessed by clicking Advanced on the Delivery tab).


Remote Domain Advanced Properties

The Advanced tab on the Remote Domain dialog box offers the following options:

  Queue messages for remote triggered delivery

  Accounts authorized to use ATRN


Queue messages for remote triggered delivery

Microsoft SMTP Service can hold mail for clients that connect periodically to download messages. In this case, the client issues an ATRN command. The remote SMTP service then starts sending messages to the ATRN domain. You can create a remote domain for an address that periodically reviews messages and enable ATRN for the domain.

To do this, click in the Queue messages for remote triggered delivery check box.


Accounts authorized to use ATRN

Displays those users and groups configured to use ATRN on this remote domain. Click Add and Remove as necessary to grant or remove ATRN authorization to users.


Domain Properties

The SMTP virtual server has at least one domain: the Local (default) domain. You can add more domains and configure them as local or remote. You can delete any domain that you create, but you cannot delete the default domain.

Domain configuration options depend on whether the domain is a Local Domain or a Remote Domain.

  Local (Default) Domain

  Local (Alias) Domain

For local default domains you can set:

  Drop directory


Local (Default) Domain

The default domain is used to stamp messages from addresses that do not have a domain. An SMTP virtual server has one default domain. It cannot be deleted unless you first designate a new default domain to take its place.

To name a default domain, you can use the name specified on the DNS tab for the TCP/IP protocol in the Network application in Control Panel as the default domain. This domain name is also used for all other services. Alternatively, you can specify a unique domain to serve as the default for Microsoft SMTP Service only.

At startup, the name designated on the DNS tab for the TCP/IP protocol in the Network application in Control Panel is automatically used for the default domain. If you change the name on the DNS tab, the new name is automatically used for the default domain when the service is next started. No action is required to update the default domain for Microsoft SMTP Service.

To override the automatic use of the network domain, name the default domain in the Domain Properties tab. Microsoft SMTP Service can then use the designated name instead of the network domain.


Alias Local Domain
Local (Alias) Domain

You can set up local alias domains that use the same settings as the default domain. Messages received by Microsoft SMTP Service for the local alias domain are stamped with the default domain name and placed in the Drop directory designated for the default domain.


Drop directory

All incoming local messages are delivered to the Drop directory set for the default domain. There are no mailboxes.

Any alias domain you create uses the same Drop directory. You can designate any directory as the Drop directory, provided it is local to the drive for Microsoft SMTP Service and is not already assigned as the Pickup directory. By default, this is a subdirectory of the Mailroot directory. To choose another location, click Browse.