• Article

SMTP connector with distribution group delivery restrictions set

[This topic is intended to address a specific issue called out by the Exchange Server Analyzer Tool. You should apply it only to systems that have had the Exchange Server Analyzer Tool run against them and are experiencing that specific issue. The Exchange Server Analyzer Tool, available as a free download, remotely collects configuration data from each server in the topology and automatically analyzes the data. The resulting report details important configuration issues, potential problems, and nondefault product settings. By following these recommendations, you can achieve better performance, scalability, reliability, and uptime. For more information about the tool or to download the latest versions, see "Microsoft Exchange Analyzers" at https://go.microsoft.com/fwlink/?linkid=34707.]  

Topic Last Modified: 2006-09-06

The Microsoft® Exchange Server Analyzer Tool queries the following attributes for each Simple Mail Transfer Protocol (SMTP) Connector object (msExchRoutingSMTPConnector) detected in the Active Directory® directory service to determine whether they have delivery restrictions set based on distribution group membership.

dLMemRejectPerms

Contains the domain names (DNs) of distribution lists (DL) whose members may not send through this SMTP Connector

dLMemSubmitPerms

Contains the domain names (DNs) of distribution lists (DL) whose members may send through this SMTP Connector

If the Exchange Server Analyzer determines that there are SMTP Connectors that have delivery restrictions set based on distribution group membership, the Exchange Server Analyzer displays a warning.

This warning indicates that delivery restrictions based on distribution group membership may affect Exchange mail flow performance.

When you send mail by using SMTP Connectors that have delivery restrictions set based on distribution group membership, the message categorizer must expand the membership of the distribution group, obtain the full list of DNs of the members, and then compare the list of DNs to the list sender’s DNs. An access operation or a deny operation occurs when a DN on both lists match. If a distribution group is nested in another distribution group, the nested distribution is also expanded.

To address this warning:

  • Design a dedicated Routing Group for connector restrictions and configure it to a local Routing Group as referenced in Microsoft Knowledge Base article 329171, "XADM: Mail Delivery Is Slow if Recipients Are Configured with Delivery Restrictions Based on Group Membership" (https://go.microsoft.com/fwlink/?linkid=3052&kbid=329171).

  • Use a dedicated and more robust global catalog server as the designated bridgehead server for the connector.

  • Configure individual mailboxes and not distribution groups for delivery restrictions as referenced in Microsoft Knowledge Base article 812298, "Mail delivery is slow after you configure delivery restrictions that are based on a distribution list" (https://go.microsoft.com/fwlink/?linkid=3052&kbid=812298).

  • Consider implementing SMTP sender filtering.

  • For servers that run Exchange Server 2003 Service Pack 2 (SP2) or a later version, consider implementing non-hierarchal restriction checking. For servers that run Exchange versions earlier than Exchange 2003 SP2, consider upgrading to Exchange 2003 SP2.

For More Information

For more information about non-hierarchal restriction checking, see Consider non-hierarchical restriction checking.

For more information about SMTP sender filtering, see "How to Enable Sender Filtering" in the Administration Guide for Exchange Server 2003 (https://go.microsoft.com/fwlink/?LinkId=72967).

For more information about the effect of distribution group restriction on Exchange mail flow, see the following Microsoft Knowledge Base articles: