Sunday, February 21, 2010

Understanding Message Tracking

Message Tracking (MT) is a tool that is part the Exchange System Manager (ESM). It reports what a given Exchange server does with particular messages. Note that tracking ends when the message leaves that Exchange server. If the message goes to another Exchange server, you can consult MT on that other server for more information.

MT can be used to determine if a message was delivered to a mailbox, or to another system. If the tracking ends without the message being delivered, you will see what Exchange was doing last. That can give clues as to what the underlying issue is.

MT can be enabled or disabled. Open the properties of the Exchange server. On the General tab there is a checkbox to Enable Message Tracking. There are also settings for log location and retention.

What's a Relay?

A Relay is essentially any system that accepts and forwards mail to SMTP domains for which it does not act authoritatively. That's a mouthful - what does that mean exactly? Let's say you address a message to uemurad@yahoo.com and send it to my corporate server. If my server accepts and forwards the message, my server is a relay. If my server accepts and forwards all messages from everyone, it's an open relay. Open relays are considered bad because Spammers find and utilize them to help disguise the source of the spam. Being an Open Relay is bad because recipient systems will see the spam coming from your system and will quickly degrade your reputation. You can end up on blacklists then have your legitimate messages rejected.

A system can be a Relay without being an Open Relay. A Relay is not a bad thing in itself.

What's a Smarthost?

A Smarthost is essentially a system to which all messages are forwarded, regardless of their ultimate destination. Examples of Smarthosts are AntiVirus appliances, Content filters, Sender/Recipient filters, and Spam filters. In addition, some ISPs and some of their service levels require customers to send all outbound mail through their systems instead of directly to recipients. A Smarthost is responsible for receiving mail and forwarding to the appropriate system. Note that it too may send messages to a Smarthost or directly to a recipient system.

Understanding Logs

Logs are nothing more than a collection of status notes a system makes about a process. They are a way to review what happened during that process to understand what worked and what didn't. Most systems have some sort of logging option. Exchange has a couple of useful logging features that you've probably heard about - Message Tracking and SMTP logging.

Enabling Message Tracking is done in the Exchange System Manager (ESM). This is done at the server level. Open the properties of the server and find the checkbox on the General tab. That configuration also defines the location of the log files and the retention period.

Enabling SMTP logging is also done in the ESM. Although this is configured per server, the configuration is found in the properties of the Default SMTP Virtual Server (expand the server, Protocols, and SMTP).

Understanding your outbound mail flow

Before you can troubleshoot why outbound mail isn't getting to where it supposed to, you first have to understand how it's supposed to get there. One of the keys to this understanding is knowing whether or not Exchange sends messages directly to recipient systems. When an Exchange server gets a message destined for the outside world, there are two main mechanisms that it consults. The Virtual Server (VS) and Connectors.

The Virtual Server setting takes precedence, so look there first. Open the Exchange System Manager (ESM) and expand to the server in question. Further expand Protocols and SMTP. Beneath SMTP there is typically a single entry - the Default SMTP Virtual Server. Open the Properties of it, go to the Delivery tab, and click on the Advanced button. The main thing you are looking for is whether there is an entry in the Smart host field. If there is, it means that all outbound messages will be sent to that FQDN. If not, your Exchange Organization will require one or more SMTP Connectors to route outbound messages.

If the VS is not configured with a Smarthost, Exchange then looks to the Connectors for outbound routing information. The Connector structure can be simple or complex, depending upon the size of your Exchange Organization and how your enterprise wants mail to flow. For this example, let's assume the simplest configuration possible - a single Exchange server environment.

To route outbound messages, your single-server Exchange Organization requires at least one Connector (assuming you did not configure a smarthost via the VS).

Let's take a moment to review the function and difference between Exchange Administrative Groups (AG) and Exchange Routing Groups (RG). AGs allow you to easily configure administrative permissions to a group of servers, regardless of their geographic location or purpose. RGs are specifically for message routing. There is no implied correlation between any particular AG and RG.

Connectors are associated with RGs and are also referred to as SMTP Connectors.

Getting back our discussion on mail flow, in the simplest configuration you'd have a single Connector. Looking at the Properties, on the General tab there is a radio-button selection allowing you to either configure a smarthost or to use DNS.

If smarthost is selected, there should be an IP address in the field (as opposed to the FQDN format used in the VS).
If DNS is selected, it means that Exchange will attempt to send messages directly to the recipient system.