Creating a Custom Receive Connector in Exchange 2013

Receive Connectors are used to control the flow of inbound messages into Exchange. With Exchange 2013 they are configured on servers with the Transport service (all mailbox servers) or with the Front End Transport service (all Client Access servers).

This means we can configure a Receive Connector in two different places... However, the big difference is that the Front End Transport service does not queue any messages locally while the Transport service does! Therefore, if you want Exchange to queue e-mails received by a custom Receive Connector (for example, in case of a problem with the recipient’s mailbox) you have to create it on your Mailbox servers.

Obviously, all the Receive Connectors required for internal mail flow are automatically created when a Client Access server or Mailbox server is installed. While Exchange 2007/2010 Hub Transport servers were not configured out of the box to accept e-mails from the internet, the new Client Access server comes with a Receive Connector named “Default Frontend server_name” already configured to allow “Anonymous Users” to connect to it to allow inbound flow from the Internet.

But sometimes custom Receive Connectors are required for various reasons: to control which servers receive messages from a particular IP address; to configure special connector properties for messages received from a particular IP address such as allowing larger messages or more recipients per messages; or to allow servers, applications or devices such as printers to establish unauthenticated SMTP connections to Exchange in order to send e-mails.

To create Receive Connectors in Exchange 2013 we can use the Exchange Administration Center [EAC] or the Exchange Management Shell [EMS]. In this tip, we will be using the Shell to create a Receive Connector that:
• Is associated with the Mailbox server called MBX1;
• Listens for incoming SMTP connections on the IP address 10.10.1.1 and port 25;
• Accepts incoming SMTP connections only from the IP range of 192.168.1.1 to 192.168.1.10;
• Accepts e-mails of a size up to 50MB;

New-ReceiveConnector -Name “Application 1” –Server MBX1 -Usage Custom -Bindings 10.10.1.1:25 -RemoteIPRanges 192.168.1.1-192.168.1.10 -MaxMessageSize 50MB

But what if a server is multi-role and has the Client Access and Mailbox server roles? How does Exchange know which role to associate the Receive Connector with? For these situations we have the TransportRole parameter exactly to designate the server role associated with this connector. The valid types are FrontendTransport and HubTransport.

So our example would become:

New-ReceiveConnector -Name “Application 1” –Server MBX1 -Usage Custom -Bindings 10.10.1.1:25 -RemoteIPRanges 192.168.1.1-192.168.1.10 -MaxMessageSize 50MB –TransportRole HubTransport

Update IPs on Receive Connectors

If you have multiple HUB servers and ever had to update one or more IP addresses from a custom Receive Connector, you know how much work it is involved. Especially if you have to do this often.

If this is your case, here’s how you can easily remove (or add) IPs from a receive connector across all your HUB servers:

# Get Receive Connectors to update
$recCons = Get-ReceiveConnector | Where {$_.Name -match "Unauthenticated SMTP"}

ForEach ($recCon in $recCons)
{
   Write-Host "Updating", $recCon.Identity

   $recCon.RemoteIPRanges -= "10.101.74.10"
   $recCon.RemoteIPRanges -= "10.102.34.12"

   Set-ReceiveConnector $recCon -RemoteIPRanges $recCon.RemoteIPRanges
}

Hope this helps!

Receive Connector Rejected an Incoming Connection

On an Exchange server, you might get the error below if you have a server or an application creating more than 20 concurrent connections to a custom Receive Connector:

Log Name:      Application

Source:        MSExchangeTransport

Date:          04/20/2012 16:15:52

Event ID:      1021

Task Category: SmtpReceive

Level:         Warning

Keywords:      Classic

User:          N/A

Computer:      HTCAS1.letsexchange.com

Description:

Receive connector "Unauthenticated SMTP" rejected an incoming connection from IP address xxx.xxx.xxx.xxx. The maximum number of connections per source (20) for this connector has been reached by this source IP address.

This means that you have a large number of connections coming from the same IP address. To prevent connections from being rejected, if this volume of connections is normal, you have to change the maximum number of connections per source.

To check the current limit (20 by default), run the following cmdlet and look for MaxInboundConnectionPerSource:

Get-ReceiveConnector <server_name>\<name> | Select *MaxInbound*

To increase the limit, you have to use the Exchange Management Shell:

Set-ReceiveConnector <server_name>\<name> -MaxInboundConnectionPerSource 500 -MaxInboundConnectionPercentagePerSource 100

If you have the same receive connector in multiple servers, you can run the following cmdlet instead to update all at the same time and in one go:

Get-ReceiveConnector *\<name> | Set-ReceiveConnector -MaxInboundConnectionPerSource 500 -MaxInboundConnectionPercentagePerSource 100

Hope this helps!

550 5.7.1 Unable to relay

Due to a change in our Call Logging system (the application the Help Desk uses to log IT service calls for users), I had to allow it to send e-mails as coming from the Help Desk mailbox to external users (similar to Send-As permissions).

So, I create a new receive connector, called Infra, just for the servers hosting that application and allowed for anonymous users to use it as the application doesn’t support authenticated SMTP...

This grants permissions to the anonymous account but it still doesn’t give you the relay permission. If you try to relay using this send connector, you will get the following SMTP error message:

550 5.7.1 Unable to relay


The ACL that controls relay is the ms-Exch-SMTP-Accept-Any-Recipient. To add this ACL to this receive connector, we have to use Exchange Management Shell:

Get-ReceiveConnector "Infra"
Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "ms-Exch-SMTP-Accept-Any-Recipient"


Please, don’t forget to keep relay as restricted as possible, as your domain might get black-listed!