Prev: Firewall Appliance Recommendation
Next: Active Directory problems/dcdiag error
From: Cliff Galiher - MVP on 11 Apr 2010 19:07
No. SBS is not a smarthost under a normal configuration. A smarthost is
one that relays SMTP traffic on behalf of another MTA. Since outlook and
OWA are both clients and not MTAs, the strict definition of smarthost does
not apply.

More importantly however, is that SBS uses a concept of connectors and "SMTP
Virtual Servers" (an unfortunate name in this day and age of virtualization
that causes confusion) to which filters get applied. Of particular note
from your quote below "SMTP AUTH" is important. In a default SBS
connection, an authorized connection bypasses Exchange spam filters,
INCLUDING IMF and RBLs. This means that you could set up an external linux
webserver on a third-party hosting company and it could mail through your
exchange server all day...which you might want to do if you don't want to
maintain a more complex SPF record, for example...and all the mail from that
webserver will appear to come from Exchange. Exchange will, however, NOT
filter that webservers messages for spam because the webserver is
authenticating.

Inbound mail, conversely, is delivered by anonymous connections (unless you
are in the habit of giving out passwords) and, as such, spam filters apply.

So no, in a default SBS configuration your "customers" (whether that is
outlook, OWA, or an external authorized server) will bypass any RBL settings
you have set up and thus you are, in fact, complying with the advice given.

Hope that clears things up.

-Cliff


"Milhouse Van Houten" <btvs(a)myrealbox.com> wrote in message
news:OREb3zb2KHA.4332(a)TK2MSFTNGP02.phx.gbl...
> OK, great. The last question is how it is that the following warning
> doesn't seem to be applicable to SBS. Isn't Exchange at least one of
> these things?
>
> "Caution: Because ZEN includes the XBL and PBL lists, do not use ZEN on
> smarthosts or SMTP AUTH outbound servers for your own customers (or you
> risk blocking your own customers)."
>
> "Russ SBITS.Biz [SBS-MVP]" <russ(a)REMOVETHIS.sbits.biz> wrote in message
> news:D1CCC999-3D9D-41DC-AAA9-2B72CCBA29E1(a)microsoft.com...
>> Having a Dynamic IP doesn't stop you from sending email out
>> it just stops the people who don't know how to get around it.
>>
>> There are legit ways around getting the Dynamic IP on a business.
>>
>> So IMO Block all Dynamic and the Businesses
>> that have a Dynamic IP, will have a SMART Technical Advisor
>> that will know how to get by this limitation.
>>
>> I currently have 2 Clients that a Dynamic IP is all they can get.
>> (one in the UK)
>>
>> And they have NO issues with SBS sending email
>> or Receiving (And they don't use the POP3 Connector)
>>
>> It comes to a matter of the IT Advisor knowing what to do.
>>
>> SO use Zen.SpamHaus.org
>> And it will block the dynamic IPs with the illegitimate servers
>> and in reality, isn't that the goal?
>>
>> Russ
>>
>> --
>> Russell Grover - SBITS.Biz [SBS-MVP]
>> MCP, MCPS, MCNPS, SBSC
>> Small Business Server/Computer Support - www.SBITS.Biz
>> Question or Second Opinion - www.PersonalITConsultant.com
>> BPOS - Microsoft Online Services - www.Microsoft-Online-Services.com
>> http://www.twitter.com/SBITSdotBiz
>
From: Ace Fekay [MVP-DS, MCT] on 12 Apr 2010 08:53
"Milhouse Van Houten" <btvs(a)myrealbox.com> wrote in message news:OREb3zb2KHA.4332(a)TK2MSFTNGP02.phx.gbl...
> OK, great. The last question is how it is that the following warning doesn't
> seem to be applicable to SBS. Isn't Exchange at least one of these things?
>
> "Caution: Because ZEN includes the XBL and PBL lists, do not use ZEN on
> smarthosts or SMTP AUTH outbound servers for your own customers (or you risk
> blocking your own customers)."
>

In addition to what Cliff said, a smarthost is a completely separate machine that your SBS or any other Exchange installation, is sending out to the smarthost, which then sends out to the internet, and reverse, where it receives all emails from the internet before forwarding on to the SBS or an other Exchange installation. Since the smarthost is not part of the infrastructure, whether it is installed internally or out on the internet somewhere, if using an RBL, and your own system is on a block list, it will block your own emails.

It can be applicable if using SBS, but it all depends on how it's setup. If using a third party tool that you don't have the internal organization defined on it, and is simply checking for spam, then forwarding (or relaying) to the SBS or any internal Exchange server, then in that scenario it may block legit emails to your org.

In an enterprise configuration, we would use an Edge subscription, which is essentially a smarthost that has info configured about the internal org so if it is on an RBL, it won't be blocked. This doesn't include SBS, but is something that's offered with EBS.

So in your case, I wouldn't worry about it.

I hope that makes sense.

From: Milhouse Van Houten on 12 Apr 2010 17:31
A big thanks to you and Cliff for nailing down these fine details. Very
helpful.

"Ace Fekay [MVP-DS, MCT]" <aceman(a)mvps.RemoveThisPart.org> wrote in message
news:#kVBn8j2KHA.4016(a)TK2MSFTNGP05.phx.gbl...
> "Milhouse Van Houten" <btvs(a)myrealbox.com> wrote in message
> news:OREb3zb2KHA.4332(a)TK2MSFTNGP02.phx.gbl...
>> OK, great. The last question is how it is that the following warning
>> doesn't
>> seem to be applicable to SBS. Isn't Exchange at least one of these
>> things?
>>
>> "Caution: Because ZEN includes the XBL and PBL lists, do not use ZEN on
>> smarthosts or SMTP AUTH outbound servers for your own customers (or you
>> risk
>> blocking your own customers)."
>>
>
> In addition to what Cliff said, a smarthost is a completely separate
> machine that your SBS or any other Exchange installation, is sending out
> to the smarthost, which then sends out to the internet, and reverse, where
> it receives all emails from the internet before forwarding on to the SBS
> or an other Exchange installation. Since the smarthost is not part of the
> infrastructure, whether it is installed internally or out on the internet
> somewhere, if using an RBL, and your own system is on a block list, it
> will block your own emails.
>
> It can be applicable if using SBS, but it all depends on how it's setup.
> If using a third party tool that you don't have the internal organization
> defined on it, and is simply checking for spam, then forwarding (or
> relaying) to the SBS or any internal Exchange server, then in that
> scenario it may block legit emails to your org.
>
> In an enterprise configuration, we would use an Edge subscription, which
> is essentially a smarthost that has info configured about the internal org
> so if it is on an RBL, it won't be blocked. This doesn't include SBS, but
> is something that's offered with EBS.
>
> So in your case, I wouldn't worry about it.
>
> I hope that makes sense.
>
From: Ace Fekay [MVP-DS, MCT] on 13 Apr 2010 01:42
"Milhouse Van Houten" <btvs(a)myrealbox.com> wrote in message news:%23AZOHeo2KHA.1016(a)TK2MSFTNGP02.phx.gbl...
You are welcome.

Ace


>A big thanks to you and Cliff for nailing down these fine details. Very
> helpful.
>
> "Ace Fekay [MVP-DS, MCT]" <aceman(a)mvps.RemoveThisPart.org> wrote in message
> news:#kVBn8j2KHA.4016(a)TK2MSFTNGP05.phx.gbl...
>> "Milhouse Van Houten" <btvs(a)myrealbox.com> wrote in message
>> news:OREb3zb2KHA.4332(a)TK2MSFTNGP02.phx.gbl...
>>> OK, great. The last question is how it is that the following warning
>>> doesn't
>>> seem to be applicable to SBS. Isn't Exchange at least one of these
>>> things?
>>>
>>> "Caution: Because ZEN includes the XBL and PBL lists, do not use ZEN on
>>> smarthosts or SMTP AUTH outbound servers for your own customers (or you
>>> risk
>>> blocking your own customers)."
>>>
>>
>> In addition to what Cliff said, a smarthost is a completely separate
>> machine that your SBS or any other Exchange installation, is sending out
>> to the smarthost, which then sends out to the internet, and reverse, where
>> it receives all emails from the internet before forwarding on to the SBS
>> or an other Exchange installation. Since the smarthost is not part of the
>> infrastructure, whether it is installed internally or out on the internet
>> somewhere, if using an RBL, and your own system is on a block list, it
>> will block your own emails.
>>
>> It can be applicable if using SBS, but it all depends on how it's setup.
>> If using a third party tool that you don't have the internal organization
>> defined on it, and is simply checking for spam, then forwarding (or
>> relaying) to the SBS or any internal Exchange server, then in that
>> scenario it may block legit emails to your org.
>>
>> In an enterprise configuration, we would use an Edge subscription, which
>> is essentially a smarthost that has info configured about the internal org
>> so if it is on an RBL, it won't be blocked. This doesn't include SBS, but
>> is something that's offered with EBS.
>>
>> So in your case, I wouldn't worry about it.
>>
>> I hope that makes sense.
>>
First  |  Prev  | 
Pages: 1 2 3 4 5 6
Prev: Firewall Appliance Recommendation
Next: Active Directory problems/dcdiag error