Re: Re: Strange ports

----- Original Message ----- From: "Bojan Zdrnja" <bojan.zdrnja@xxxxxxxxx>
To: "Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>
Cc: <pen-test@xxxxxxxxxxxxxxxxx>
Sent: Saturday, June 23, 2007 12:19 AM
Subject: Re: Re: Strange ports


On 6/23/07, Thor (Hammer of God) <thor@xxxxxxxxxxxxxxx> wrote:
If you use Exchange (well, specifically, if Exchange is doing the DNS
lookup) then you do need TCP 53 as Exchange SMTP (or IIS SMTP) uses TCP by
default for DNS queries. This is actually a good thing, as it is easier to

TCP by default?

Yes, TCP by default for SMTP DNS queries. See http://support.microsoft.com/kb/263237 (that's a ex2k kb, but it still applies)

So you are saying that Exchange doesn't use system's
resolver but instead has an internal one?
This is pretty interesting, can you point to Microsoft's documentation
about this?

Indeed - Exchange uses a separate DNS configuration for host resolution of SMTP destinations (when configured). When you consider the heavy requirement for Exchange to be integrated with Active Directory, you identify the fact that the "local" IP stack has to point to internal AD DNS to function properly. Therefore, Exchange allows you to set DNS settings specifically for the SMTP virtual server's use if it can't resolve hosts via your internal DNS design-- like when you have root zones in your AD or you've isolated internal DNS without forwarders.

You go the the properties of an SMTP virtual server, go to the Delivery tab, click Advanced, and then click Configure to configure external DNS servers separate from the local stack. If this option is not configured, then standard DNS settings of the adapter stack are used, but resolution is still TCP by default.

HTH

t

-------------
Veni, vidi, veni denuo.

Check out Thor's "Microsoft Ninjitsu: Blackbelt Edition" training at Blackhat Vegas!
http://www.blackhat.com/html/bh-usa-07/train-bh-us-07-tm-ms-bbe.html


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------

Relevant Pages

  • Re: NDR delivery delayed errors keep coming, any advice?
    ... Unless you've got a complete set of DNS records, including reverse MX and SPF, you may have trouble sending via DNS to some domains. ... Check your exchange queues, and see if you can determine the reason why the ... Telnet to Port 25 to Test SMTP Communication ... On the Diagnostics Logging tab, click on MSExchangeTransport, and SMTP ...
    (microsoft.public.windows.server.sbs)
  • Re: NDR delivery delayed errors keep coming, any advice?
    ... we are configured properly for DNS. ... Is there a downside to using the ISP as a Smarthost? ... All e-mails from my Exchange server to yahoo seem to be ... Telnet to Port 25 to Test SMTP Communication ...
    (microsoft.public.windows.server.sbs)
  • Exchange 2003 SP2 - able to send but not receive email
    ... OWA already setup and running - My whole goal is to setup this server to ... DNS has example.org setup in Forward lookup zone along with MX record / A ... Now onto Exchange System Manager ... SMTP - Started - Settings below ...
    (microsoft.public.exchange.admin)
  • Re: Problem sending email out of Exchange 2003
    ... My problem was resolved last night when it was found that Exchange was not ... referring DNS queries to SBS but instead had been given specific DNS ... Exchange SMTP was no longer able to query these servers. ...
    (microsoft.public.windows.server.sbs)
  • Re: Cant send email to one domain from my system but can from ano
    ... Yes Exchange is using DNS and resolutions work fine. ... >> I have an Exchange 2000 Server with latest Service Pack. ... >> SMTP Store Driver: Message Submitted from Store ...
    (microsoft.public.exchange2000.general)