Notes from the Lab

Using Computer Names in Connection Control for IIS and Exchange

June 9th, 2006

Let’s start with some well-known facts. There is a possibility to restrict IIS or Exchange Virtual Server (that is Website, SMTP, POP3, or IMAP4 Virtual Server) based on IP addresses and computer name. In order to use this feature, you need to display Virtual Server Properties window in IIS Administrator or Exchange System Manager, click on Access, tab and then click on Connection button. Then, you will see the following familiar window:



If you click Add in this window, the following window will appear:



Here, you can specify exceptions to the general rule selected in the first window. Up until now, I have been stating widely known facts. It’s pretty obvious how this option works with IP addresses, but the computer names is the whole other story. And that’s what I’d like to discuss.

It appears as if you can specify the domain name here and all the computers in this domain will be treated as exceptions. Well, that’s not true. First of all it’s not a domain. The name you specify here must be the exact match of a computer name.

But even after I said that, there is still a question. Which name to match? Short host/NetBIOS name or FQDN? Good question. That depends. The server performs a reverse DNS query based on the client’s IP address. If the query is successful, the result of that query is matched against the exceptions list. The result, of course, is usually FQDN. If that query fails, server uses whatever name supplied by the client which is usually the host/NetBIOS name.

I hope this helps. Oh, wait… I hope it doesn’t. Because it’s strongly recommended not to use computer names in that exceptions list. Try to use IP addresses only. Names in that list put a huge burden on a server because it needs to perform a reverse DNS query against every SMTP client.

Now I hope this helps…

Entry Filed under: Exchange