External Email Forwarding Fails

So I have an interesting little problem I'm looking into for one of our clients --

They're in an Exchange environment. First, the user set his Outlook to forward his mail from his address to another internal email address. No problem. The new mail enters his inbox briefly, then immediately passes on to the forwarded address. Then, he changed it to forward to an external email (his hotmail address in this case). This time, the new mail comes in, and nothing happens; it stays in the inbox. So he tried to send it manually, and it does move into the Sent Items folder, but it never arrives in the destination inbox. He's tested this with several different external email accounts (hotmail, yahoo, and charter), and he experiences the same problem each time. So evidently his mail will only successfully forward to internal email addresses.

He noted that they had a problem with people forwarding email too often a couple of years ago. He said that he suspects that perhaps whoever resolved that problem back then may have set some sort of restriction in Exchange to prevent them from forwarding anything to external email addresses. However, he says he checked all the Exchange policies, and everything is on a "low" setting.

So what I did was tinker around with forwarding in Exchange. I'm new to Exchange, so I'm literally learning as I go here, but I managed to create a contact object in AD Users & Computers that contained his hotmail address, then set his user account in AD to forward all email to that object. That worked.

However, that's also not what he wants. He wants to be able to set up forwarding from his Outlook client instead of having to go through the Exchange server every single time, so turns out there was no point to all that tinkering I did anyway.

So any ideas? Could there be a setting in Exchange somewhere that's preventing users from setting up external forwarding from their Outlook client aps? Or what else could cause this issue where they can forward inside but not outside?

He probably needs to be pre-authenticated to Hotmail etc. to be able to do it...

Did you ever think of using OWA? Then he can get to his inbox from anywhere via SSL whenever he wants...

That didn't occur to me actually. I'll have to recommend that.

So this is interesting -- I got curious, and tried from my email. Keep in mind this is a client problem, so my Outlook on our network managed by our Exchange server is not set up like theirs. So I set up my Outlook to forward all messages that come from my cell phone back to my cell phone -- so I've set up, from my client ap, a rule forwarding that email to an external account. Tried it out -- I sent an email from my cell to my email, and it showed up as a new message in Outlook, but it never forwarded back to my cell phone. So I can recreate the same problem here on our Exchange network. So I'm wondering -- Is there something about Exchange that overrides forwarding to the outside from being enabled client-side?

Quote:

---

Is there something about Exchange that overrides forwarding to the outside from being enabled client-side?

---

\

Yes there is otherwise Spammers would eat you alive. They would address a message to your exchange account and use you to Spam away. Chips Ahoy.

Found it -- it's an obscure little checkbox...

Go into Exchange System Manager --> Global Settings --> Internet Message Format, and right-click Default. Go into the Advanced tab and lo and behold, there's a little checkbox beside "Allow automatic forward".

Very rare I actually manage to answer my own thread. :D

know the dangers involved in forwarding external mail addresses to external mailboxes.

Then why would you do it... ;)

OWA works and has been proven quite secure...

I agree, but it's not my network. Note in the above post that email forwarding actually was a problem for them in the past too, so you'd think they'd have learned their lesson then eh? Regardless of whether it's a good idea or not, that's what they want though, and "the customer is always...WRONG!!!!" But oh well!

Quote:

---

Then why would you do it...

---

It's disabled for a reason. I would NOT do it. :p

OWA is slick. But I don't use it either.

Quote:

---

Regardless of whether it's a good idea or not, that's what they want though, and "the customer is always...WRONG!!!!"

---

In that case count the days until their server is hijacked and taken offline or permanently destroyed.

Hijacked? I can see enabling email forwarding opening the door for overloading the server depending on how irresponsible/clueless users are, but how could a server be totally hijacked due to only that being enabled?

Road:

OWA is "slick"...

It's also proved itself to me to be pretty darned secure, reliable and easy for about 18 months to 2 years now.... I really like it... Yes, it's a "hole" through to the exchange server... and therefore on inwards... and I was very leary over implementing it... But it has proved itself to be pretty solid... So I'll recommend it...

If this is a corporate environment, you've gotta wonder that maybe that functionality was disabled because of policy...

Personally, I would never forward corporate email to external addresses... esp not hotmail/yahoo. Give the guy remote access or use the exchange web client.

Well thats my thoughts anyway... Sorry I can't help with the actual problem...

---

My bad... had this thread open from 1 hour ago only just answered... please disregard!

Quote:

---

Hijacked? I can see enabling email forwarding opening the door for overloading the server depending on how irresponsible/clueless users are, but how could a server be totally hijacked due to only that being enabled?

---

SMTP server is a full service running on the mail server. You can use internal mailboxes and just manipulate the SMTP commands to take multiple mail boxes say 10, and forward them to literally millions of mailboxes all over the world. Without EVER making it to the outlook client. This will hijack your server because legitimate corporate mail will not get sent. Not to mention it could eat all the network bandwidth so that legitimate users cannot get to the internet. And with that will come thousands if not millions of non delivery reports which will fill up the server hard drive to the point that exchange will not start, the server may not boot and if there isn't a decent backup the entire mail store could be lost through a corrupted exchange log. That is the definition of "hi-jack". ;) In this way someone else tells your mail box to forward mail and controls the mail going through it. Just wait some spam bot will find it.

OWA... Someday. I wouldn't house it off my core though. I would have to segregate the network to feel safe and sleep at night. ;)

Quote:

---

I would have to segregate the network to feel safe and sleep at night.

---

But in order to segregate _and_ allow the functionality you have to open almost a dozen ports from the DMZ to the trusted to allow it to work. I'll take the single port, (SSL - 443), direct to the trusted and not have to bother about monitoring so many ports and so many transactions per day... I just feel a little safer having that smaller "choke point".... :)

I have been thinking of a cheap DSL line to house OWA. To segregate it a little. Or co-locate a mail server outside my core and connect remotely with only outgoing connections initiated on a new domain.