Microsoft Exchange and Remote Desktop Services Specialists

SEMblog

Microsoft Exchange Server and
Blackberry Enterprise Server news, views and fixes.

Where to get free support for Microsoft Exchange Server

If you are having problems with your Exchange server, you have a number of sources for assistance. 

You can Google for the problem, and in many cases this will bring up something that can assist you.

If you have a fairly specific problem though, you might need to actually explain it to someone to get assistance. For that you have two main sources. 

1. Microsoft Support - this is of course a chargeable solution. 

2. Peer to peer support. 

The second option is very popular and is where you can get assistance from some of the top Exchange experts. Exchange MVPs (like myself) post in peer to peer locations, as do some Microsoft employees. 

Where to find peer to peer support

With the demise of the Microsoft Newsgroups, peer to peer support pretty much comes in two forms. 

  • Forums
  • Email Lists

Email Lists

One of the most active email lists was hosted by Sunbelt Software, who were acquired by GFI. GFI have now announced the lists are going away, so the new list can be found at "My IT Forum" http://myitforum.com/myitforumwp/services/email-lists/  

Yahoo Groups also have email lists for each version of Exchange, however these appear to be very low traffic. 

Use an Outlook.com account or a public folder to store the list traffic - they can get very busy and by putting the content in to a separate place it will keep it from your main email. 

Forums

There are lots of forums where you can get support for Microsoft Exchange. 

Microsoft Technet

Exchange 2013: http://social.technet.microsoft.com/Forums/en-US/category/exchangeserver

Previous Versions: http://social.technet.microsoft.com/Forums/en-US/category/exchangeserverlegacy 

Very busy forums, which are monitored by Microsoft staff. However there are a lot categories therefore working out where to post can be a challenge. 

Experts Exchange

The Exchange section is very active and is one of the main places you will find me posting. Contrary to popular belief, you don't need to pay to either see the solutions or post a question. A free account can be created here: http://semb.ee/ee

Petri

Exchange 2000/2003: http://www.petri.co.il/forums/forumdisplay.php?f=12 

Exchange 2007/2010/2013: http://www.petri.co.il/forums/forumdisplay.php?f=36  

Another forum where you will find me posting, I also moderate the Exchange forums. Not quite as busy as some, but knowledgeable people post. 

Msexchange.org

http://forums.msexchange.org/ 

Another forum divided in to categories. 

There are other forums out there, but have very low traffic, which means your question may go unanswered. 

You can also find groups on Linked In, if you have an account there. 

More ways to get assistance can be found on my list of Exchange resources at http://exbpa.com/ 

DMARC

You may have heard of an email initiative called DMARC, which is supported by many of the major email providers. What is DMARC and how does it benefit Exchange server administrators.?

What is DMARC?

DMARC - Domain-based Message, Authentication, Reporting and Conformance is basically a standardisation of how is email is handled by a number of email authentication mechanisms such as SPF. 

As an email server admin the interesting part it introduces is the reporting aspect. 

History

Little bit of history to begin with. 

Spam has been an on-going problem for over 20 years and it was identified that one of the most common issues with spam is spoofing - where an email is sent with the From address being inaccurate. 

One of the initial ways to try and deal with that issue was SPF - Sender Policy Framework, also known as Sender-ID. This uses DNS records to indicate what IP address and hosts can send email for a domain - the idea being that by putting additional records in your own DNS, you can tell the world where your email should be coming from.  

As an email server admin, SPF had a number of drawbacks. 

The first one was that it had zero effect on the amount of spam that you received yourself. For most email server administrators, that is all they are worried about. 

The other major drawback is that if you did implement the SPF DNS records, you had no way of knowing if it was effective or not. The lack of feedback means that most SPF records are very conservative in configuration, so that people don't block legitimate email. 

DMARC Features

There are two key features of DMARC.

First, it tells the major providers what to do with email messages that are protected by SPF records in a standard way. It takes the guesswork out of the process. 

Secondly, is to provide the administrator of the email domain with reports (in a standard XML format) of whether email has been blocked or not. Reports come from a number of major email providers, including Google, Hotmail, Yahoo and AOL. It also tells the major providers what to do with email if they fail the SPF records checks. 

DMARC also supports Domain Keys, but their implementation is limited so not covered in this article. 

DMARC protects over 60% of consumer mailboxes, so if you are emailing a lot of home users then you will get results from deploying it. 

Setting up DMARC to get the reports

The reports are probably the most interesting aspect and this is what this blog is mainly about. 

There are three steps to the process. 

1. Setup your SPF records correctly.

2. Setup an email address for receiving the reports.

3. Setting up the DNS records. 

SPF Record Setup

For DMARC to work correctly, you need to have SPF records setup in the correct way. A lot of SPF records have been configured with ~all parameter, which basically means that any server can send email for that domain. That needs to be replaced with specifics. 

The easiest way to get the SPF records setup correctly is to use a tool: http://spfwizard.com/

You need to list everything that could send email as your domain. If you are hosting your own server, then using the MX record method might be enough. However if you send email via a smart host, then the smart host will need to be listed. Don't forget to include any web servers that might be sending email based on scripts. 

You can then setup the records to effectively report only, so take no action. That will allow you to build up a picture of what is happening before you implement blocking procedures. That DMARC standard was written to allow this exact scenario, so that you can build up confidence in the results. 

Email address for the reports

The email address that receives the reports goes in to DNS entries so could be queried and then used to send spam (oh the irony). Therefore I would suggest that you setup a specific alias or group (dmarc@example.com) which can be changed if it starts to be abused. 

There are actually two types of messages that you can receive - reports and status messages. You can use the same email address for both. 

DNS records

The final step is to configure the DNS record. Again an online wizard is the easiest way to do this, which will generate the record in the correct format. 

http://www.unlocktheinbox.com/dmarcwizard.aspx 

With the record text created, you just need to create a new TXT record in your domain and paste the text. Watch that some DNS providers do not want the record enclosed in "". 

After about 48 hours, you will start to get report emails. These will be zipped up and attached to the email. 

Reading the Reports

The reports are XML, so might not make a huge amount of sense. Fortunately web sites which can interpret these reports have been created. 

The way that these web sites are designed to work is to put an email address they provide in to your DMARC record. What I prefer to do is take that email address and put it in to a mail enabled contact in Exchange, then add it to the group I created in the second step above. This group can then include an internal recipient as well so I can see the reports are coming in. 

DMARC Analysis

http://dmartian.com/ 

http://www.dmarcanalyzer.com/

What to do with the results

After you have had DMARC running for a little while you will be able to see if email is coming from other places and needs to be included in the SPF records. As you refine the PSF records and your message delivery you will be able to move to DMARC settings that say to reject the messages. 

However the results can also give you a good idea of how your domain is being used.

I implemented DMARC with a client in late 2012. After a few weeks we noticed that a Dutch server was coming up as a source. The client identified that an ex member of staff was sending out email using addresses on their domain. They were able to stop this, plus using DMARC able to ensure the messages were blocked. 

More Information

The dmarc project web site is at http://www.dmarc.org/ 

The FAQ explains in more depth what the project does: http://www.dmarc.org/faq.html

April 1st

In my house April 1st is greeted with some trepidation.

I don't mean the April fools jokes, trying to spot when friends and families are trying to catch you out, but something else.

For me, April 1st is when I hear if Microsoft have honoured me with MVP status for another year.

MVPs are awarded annually, and this happens every quarter. I am on the 2nd quarter, so get the email on April 1st. No doubt there are many newcomers to the programme who think it is a joke, particularly if they haven't had contact from Microsoft beforehand to give them an indication that they are being considered.

My MVP, for the Microsoft Exchange product, was first awarded in 2005 and I have been fortunate enough to be re-awarded every year since. It is nice to be recognised for the contribution I make to the Exchange community.

This year April is looking like a busy month, with Cumulative Update 1 for Exchange 2013 being released and the migrations to the new version beginning. 

Sembee Ltd @ 10 - A Retrospective Look at the First 10 Years

Ten years ago I sat in my small flat in Hampshire, logged on to a web site and after handing over my credit card details a new company was born - Amset IT Solutions Ltd.

The name Amset I had been using on and off since 1997. At my first real IT job all of our computers were named after Egyptian gods and mine was called Amset. I continued to use that name for computers later in my career and when I was searching for a name it was the natural choice. I had amset.co.uk since 2000 but being naive, I had failed to pick up amset.com, which was registered a few months later. That wasn't a mistake I made again.

The idea at the time was to be an IT support company. I had been made redundant again and the job hunting wasn't going very well, so I decided to go it alone. That had always been my life goal, but it was earlier than I expected.

I took a mortgage holiday and had savings from an aborted house purchase earlier that year and took the plunge.

Alas my first foray wasn't very successful. I engaged a marketing company to assist me, but it quickly became apparent that I was going to struggle on two main points.

I didn't have a unique selling point, so it was impossible to make myself look different to all of the other IT companies out there.
The other problem was that it was just me and when companies asked about what would happen if I was unavailable, I was unable to answer (what I have called the run over by a bus question).

I did acquire one client in those first few months, and they are still with me today.

Therefore by September 2003 I was running out of money. The mortgage holiday was about to end and I had almost no business to show for it. I took a contract to keep my head above water and then found myself a full time job. I retained the company, but in that first year I turned over less than £5,000 - the company made no profit, owing me more than that.

The next financial year was even worse, with the company turning over less than £1000.

In 2004 though, I was introduced to Exchange 2003. My employer wanted to do a migration and I had to learn fast. I spent time on forums and realised I was able to answer more questions than I asked. That set me on the path to Exchange MVP status.

In late 2005 I got my first major Exchange job of my own. I took ten days off work and went and worked for them. I earned more on that first job for eight days than I did in four months at my full time job. It will not surprise you that I came back and immediately handed in my notice. I was on a three month notice period, so in February 2006 Amset IT Solutions Ltd became my employer again. 

In early 2008 I had an inspired idea in the shower one morning, and created certificatesforexchange.com, which has been a huge success.

In 2009 I decided to change the company name to Sembee Ltd, as that was the name I was known as on the Internet, and it seemed a good idea to trade on that name rather than the previous name. I had already been using it for my personal Exchange blog, but it was becoming apparent that it was all merging together.

So here I am in 2013, with a successful limited company that has been based on all of my own work. The Exchange work is done exclusively by myself, I don't contract the work out. It was a very difficult road, but the work has paid off.

If you are thinking of starting your own business in IT, then some words of advice.

If you are on your own - specialise. Being too generic and you will just get drowned out by all the other generic companies. However do not be too focused. While I am an Exchange specialist, because of my background in general network administration I can do some Active Directory work, I often setup domains and resolve other issues unrelated to Exchange. My oldest client in Basingstoke I maintain their entire network, one of the handful that I do that for.

The next piece of advice is you need cash. I don't mean to get the company off the ground, but to live on. I took a mortgage holiday, but I was still burning through a lot of money every month. Work out what you need to live on and have at least six months buried away. I now retain six months of funds at all times - I keep mine in Premium Bonds. I can get it if I need it, but I don't have immediate access to it.

The final piece of advice is to take a break as often as you can. For some months while starting the business and the second coming in 2006 I didn't talk to anyone other than clients. Didn't step outside of my flat, was completely isolated. Not good for me.

While taking a holiday isn't always a good idea at the start (being away from a new business for a week or more might be fatal) there is nothing to stop you from getting away for a few hours.
I started to visit the New Forest, which is about an hour away, going right down to the coast. There I would visit Hurst Castle, which is on the end of a long spit in to the Solent. I would just walk out to the castle, walk round and then walk back. My Blackberry works all of the way because the Isle of Wight isn't far away, but it got me out and because of the wind blew the cobwebs away. Very invigorating and just cost me the petrol money.

I hope you have found this article interesting. I will be returning to blogging on Exchange over the next couple of weeks. Here is to the next 10 years. 

SSL Compatibility and Testing

SSL certificates are a constant source of pain for Exchange administrators. With Exchange 2007 and 2010 so heavily dependant on web services, getting SSL setup correctly is important for correct operation. 

A lot of SSL certificate deployment is now being done for mobile device support, and then you open a new issue - SSL certificate compatibility. 

Recently I found a large list of SSL certificate and client compatibility. 

It is from a Danish SSL reseller called FairSSL:

http://www.ssltest.net/compare/sar.php 

Most useful for mobile platform compatibility, the combinations it lists are significant. 

On the same site they also have a tool to verify that your SSL certificate is installed correctly. Most of the SSL vendors also provide this, but if you don't have the login details (perhaps because the certificate was just supplied to you) then it is a useful service to have:

http://www.ssltest.net/ 

With more SSL providers now using intermediate certificates to issue the certificates, rather than the root, getting the certificates installed correctly can mean the difference between SSL working and not. 

[ad]