Problems When Internal/External Domain Names the Same

[dmanlam]

Configuration:
Our internal AD domain name is abccompany.com. This happens to be the exact same name as our internet-registered domain name. No problems with that. We use Exchange internally only. For internet email we have a 3rd party who hosts our "domain". All of our Outlook clients are configured with an Internet Email service that points to the external servers for sending/receiving email. Additionally, each Outlook client is set up with the Exchange service for sending/receiving internal emails, etc.
Problems:
1) How can we send email to a company member's EXTERNAL email address when the domain names are the same?
Whenever we input their external address (user1@abccompany.com), the Exchange server automatically translates this back to their internal Exchange address and it never gets outside of our network. This is a real problem when our techs are out on the field and someone back at the office needs to send them something via email (which they can pick up via the 3rd party's web email client). Is there a way to tell Exchange not to "translate" addresses? Is there a way to configure people's addresses differently via AD (addresses are automatically config'd for each domain acct that has an Exchange mailbox....SMTP: username@abccompany.com)
2) If I set up an SMTP Connector and input abccompany.com into the "Address Space" tab, it seems to alleviate the "translation" problem described above. Is this the right way to set this up?
This seemed to prevent Exchange from translating user1@abccompany.com into the internal Exchange address; however, sending internal emails to recipients gets screwed up. These messages seem to sit in a queue on the SMTP Virtual server and don't go anywhere.

HELP!! Any help would be HUGELY appreciated.
Thanks
Drew

 

[dankelt]

I can't think of a good way of doing this using abccompany.com as both domains. I would setup another domain, perhaps called something like internal.abccompany.com and use that for your internal addresses.

Dan

 

[dmanlam]

Setting up our internal domain as a "child" domain of our real internet name does sound like a smarter idea. However, we already set everything up this way and have been running smoothly for over a month. I doubt management is going to accept more changes (they were very pleased that a smooth-running network had finally been put in place). Poor planning, I guess, but I didn't foresee such a scenario happening. How much effort would it be to re-configure the domain as a sub-domain, like you mentioned? Would we have to trash the domain controllers and reinstall AD/Exchange??

Would this problem disappear if we dropped our 3rd party ISP hoster and put our Exchange server inside a company-controlled DMZ?

Thanks Dan,
Drew

 

[dankelt]

Yes, you could put your exchange server out on your DMZ. But then you have security issues to deal with, like keeping spammers from relaying through your server.

As far as setting up a new domain, you can probably leave your current domain alone. Just add the internal domain into your DNS server(s) with a MX record pointing to your exchange server.
You will also have to make sure you Exchange SMTP virtual server is pointed to your DNS server(s)

Dan

 

[dmanlam]

So, it could be as easy as setting up an MX record that points to our Exchange server? On the SMTP Virtual server for Exchange, should it then be configured to point to our external/ISP-provided DNS server? Currently, our internal DNS server forwards out any request it cannot handle, which is pretty much everything. All of our clients point to the internal DNS server and then that DNS server forwards out to the ISP-provided DNS servers.

 

[dankelt]

Well, I've been thinking about this... and it keeps getting more and more complicated. There might be a way to get this to work without exposing your exchange server to the outside world. It will be combersome, and a little bit of work. The better option, may be to do like you say and have your isp stop hosting your email, get your server in a DMZ of some kind (or some kind of public ip address), then have them point the MX record to it.

That is what I would do. It will keep things simple, everyone will have only one address to worry about, and only one server to check.

If this is not an option, I'll try to expain my other option (but i'm not even sure it will work for you)

Dan