Activating Port 587 for relaying SMTP?

[Gordon Fecyk]

My ISP's decided to block outbound port 25 on all of their dial-up and home
DSL connections. I have some clients that use my Exchange 2K server with
POP3 and IMAP clients (notably Outlook Express and Outlook 2003). Port
587's a common port for accepting relay mail over SMTP (the so-called
"SUBMIT" procedure like what AOL's using), so I figured I could set up a
second port to accept relay mail to work around my ISP's filtering.

I thought the straightforward way to do this was to create a second SMTP
Virtual Server and have it use port 587 instead of port 25. I also want to
secure this virtual server using SSL, which I've done before on the default
virtual server running on port 25 - the clients are usually set up to use
SSL and the basic authentication mode has "Require TLS" turned on.

It took some "encouragement" to make IIS work off port 587 - I had to create
the virtual server and edit its properties while the SMTP portion of IIS was
stopped. Once that was done, I could have it answer port 25 and port 587
just fine. However, SSL connections return such errors as: "Your server has
unexpectedly terminated the connection" (OE6 SP1), or, "Your server does not
support SSL" (Outlook 2003). Meanwhile I can telnet to port 587 just fine
from a remote machine, and it answers with the standard SMTP banner (?! I
thought it was supposed to require SSL when I turn on "Require SSL.")

If I disable the requirement to use SSL, it appears to work just fine, but I
don't want to expose login passwords, nor would I like to have that mail
sniffed during transmission. Like I explained, SSL on port 25 (the default
virtual server) works just fine, so I think the server certificate is
correctly set up.

So, how do I properly set up Exchange 2K / IIS5 SMTP to accept mail for
relaying on port 587, and still receive incoming mail on port 25? And how
do I require SSL (ideally 128-bit SSL) on port 587? Do I remove the cert
from the default virtual server and reapply it to the second one I created?

[Dodo]

Port 25 blocking greatly complicates matters. NOTE: If you are paying for
static IP on which ports are filtered then you are being ripped off!

You say your ISP is blocking outbound 25. In this case, client machines
would still be able to reach you mail server from the internet.

Having your mail server listen on port 587 would have the effect of allowing
client machines to access your mail server from behind an outbound port 25
block. Only one virtual server is required. Go to the virtual server general
properties and click on the advanced button to configure the virtual server
to listen on a second port.

Blocking outbound 25 on the server side would disable your mail server from
sending mail to any other mail server on the internet. The only way to
circumvent this sort of filtering is to route all mail through your ISP's
SMTP servers. Configure your ISP's SMTP server as a smart host.

[Gordon Fecyk]

Post by Dodo
Blocking outbound 25 on the server side would disable your mail server from
sending mail to any other mail server on the internet. The only way to
circumvent this sort of filtering is to route all mail through your ISP's
SMTP servers. Configure your ISP's SMTP server as a smart host.

You misinterpreted me. *MY SERVER'S* connection to the Internet is not
port-blocked. I am paying for business Internet service and from outside my
ISP's network I can connect to the machine just fine. The machine can also
connect to *other mail servers* outside of my ISP's network.

Some of my clients, who use this machine as a mail relay and mailbox server,
are on the ISP in question and cannot send mail through it on port 25.
There are other providers as well, who block port 25 outbound, who I have
clients on that can't use this machine for mail anymore.

And finally, there is the matter of using a sender verification protocol,
such as SPF or Sender ID, which requires anyone with an e-mail address in my
domain to use my mail system to send mail.

Politics aside, I have a technical problem that needs solving: How to open a
second port to relay SMTP mail through and to have that port secured through
SSL or TLS. The system must work with a variety of mail clients which
include non-Microsoft (Gasp!) clients.

[Dodo]

Having your mail server listen on port 587 would have the effect of allowing
machines to access your mail server from behind a client-side outbound 25
block. Only one virtual server is required. Go to the virtual server general
properties and click on the advanced button to configure the virtual server
to listen on port 587.

The above configuration should fully support SSL.

[Gordon Fecyk]

Post by Dodo
Having your mail server listen on port 587 would have the effect of allowing
machines to access your mail server from behind a client-side outbound 25
block. Only one virtual server is required. Go to the virtual server general
properties and click on the advanced button to configure the virtual server
to listen on port 587.
The above configuration should fully support SSL.

Oh right.

/me slaps forehead

Only it isn't working. Thanks for the pointer, however, as I forgot totally
about adding a second port.

I've since removed the second virtual server, and added port 587 to the list
of ports the default virtual server listens for. SSL on port 25 works
correctly, but SSL on port 587 still reports a "connection timeout" on
Outlook Express 6 SP1. If I disable the SSL requirement in OE, I get "550
cannot relay" from the server.

The only way I can get port 587 to relay for me is if I turn off the
"Require TLS" option in the Authentication options for the SMTP virtual
server, and I turn off "Require SSL" on the OE6 SP1 client. Again, the
virtual server has a certificate and it works... for port 25. This seems to
be the same result I arrived at when I was running a second virtual server.

I'm tempted to create an admin account for you so you can poke onto my
machine - it runs Terminal Server in Remote Administration mode.

[Dodo]

This may help:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/webapp/iis/ssldiags.mspx

[Dodo]

SSL certificates for websites are bound to a one or more sockets. IIS
Advanced Web Site Properties provides the interface for defining multiple
sockets for a web site. The IIS SMTP service does not provide an interface
for binding a certificate to more than one socket, that I know of. There
might be something in the SMTP Secure Communication Properties. I'd try
removing and re-installing the certificate. If that fails, I'd try and find
out what to what socket the certificate is bound and see if there's a way to
bind it to a second socket.