Exchange Smart Host Setup

1. 1

   Open the new Send connector wizard in the EAC

   In the Exchange admin center go to the Send connectors tab under Mail flow and click Add. In the wizard that opens, give the connector a name and choose Custom as the Type.

   EAC PATH copy

   Mail flow › Send connectors › Add › New Send connector
   #  Name: MXGate Smarthost   ·   Type: Custom

2. 2

   Choose smart host routing and add the address

   On the second page of the wizard select Route mail through smart hosts, click Add, and enter the name of the MXGate server in the dialog that opens. The source servers must be able to resolve this name through DNS.

   ADD SMART HOST copy

   # Fully qualified domain name (FQDN)
   smtp.mxgate.com.tr

   You can also give an IP address here, but the TLS-based authentication in the next step requires the server certificate to contain this exact fully qualified domain name. Use the name, not the IP.
3. 3

   Choose the authentication method

   In the Route mail through smart hosts section select Offer basic authentication only after starting TLS and enter the username and password from your MXGate panel. This option sends the credentials only after TLS has been established.

   New Send connector › Route mail through smart hosts

   None

   Basic authentication

   Offer basic authentication only after starting TLS

   Username

   username from the panel

   Password

   ••••••••••••

   Exchange Server authentication

   Externally secured

   Back Next

   A representation of the screen. The option names match the English labels in the Exchange admin center.

   The other four options are not suitable for the MXGate connection; the table below compares what each of them does.
4. 4

   Define the address space and the source servers

   In the Address space section enter SMTP as the Type, an asterisk as the fully qualified domain name and 1 as the Cost. Then, in the Source server section, select the Mailbox servers that will send mail to the smart host and finish the wizard.

   ADDRESS SPACE copy

   # Type        SMTP
   # FQDN        *   (all external domains)
   # Cost        1   (a lower value means a more preferred route)

   If you have multiple Active Directory sites, the Scoped send connector box limits the connector to the same site. If you leave it unticked the connector is usable by every transport server in the forest, which is the default.
5. 5

   Set the port to 587

   The wizard has no port field and the connector is created with port 25. Because the MXGate connection uses 587, you have to set this value separately from the shell. This is the most commonly skipped step in the setup.

   EXCHANGE MANAGEMENT SHELL copy

   Set-SendConnector -Identity "MXGate Smarthost" -Port 587
   
   # If you prefer to create the whole connector in one command
   $cred = Get-Credential
   New-SendConnector -Name "MXGate Smarthost" -Custom -AddressSpaces "*" `
     -DNSRoutingEnabled $false -SmartHosts "smtp.mxgate.com.tr" `
     -SmartHostAuthMechanism BasicAuthRequireTLS -AuthenticationCredential $cred `
     -Port 587 -RequireTLS $true

   The default port is 25. Without this command the connector looks correct but never connects to 587, and you see timeout errors in the queue.
6. 6

   Verify the settings

   You can see whether the connector really has the values you expect with a single command in the shell. Check the port, the authentication mechanism and that DNS routing is off in particular.

   EXCHANGE MANAGEMENT SHELL copy

   Get-SendConnector "MXGate Smarthost" | Format-List `
     Name, SmartHosts, Port, SmartHostAuthMechanism, DNSRoutingEnabled, RequireTLS
   
   # Expected values
   #   SmartHosts             : [smtp.mxgate.com.tr]
   #   Port                   : 587
   #   SmartHostAuthMechanism : BasicAuthRequireTLS
   #   DNSRoutingEnabled      : False

7. 7

   Send a test and read the protocol log

   Turn protocol logging up to verbose for the connector, send a message from a user to an external address, and follow the session with MXGate in the log. When you see a 250 response in the log, the setup is working.

   LOGGING copy

   Set-SendConnector -Identity "MXGate Smarthost" -ProtocolLoggingLevel Verbose
   
   # Default log location
   %ExchangeInstallPath%TransportRoles\Logs\Hub\ProtocolLog\SmtpSend
   
   # Anything stuck in the queue?
   Get-Queue | Where-Object { $_.Identity -like "*MXGate*" }

   Setup complete. Once the log shows the TLS session with MXGate and the message accepted with a 250 response, outbound mail is going through MXGate authenticated and encrypted. Set the logging level back to None when you have finished troubleshooting.

The interface labels and parameter names come from the vendor documentation: Create a Send connector to route outbound mail through a smart host and New-SendConnector.