Domain Security refers to the set of functionality in Exchange 2007 and Microsoft Office Outlook 2007 that provides a relatively low-cost alternative to S/MIME or other message-level over-the-Internet security solutions. The purpose of the Domain Security feature set is to provide administrators a way to manage secured message paths between domains over the Internet. After these secured message paths are configured, messages that have successfully traveled over the secured path from an authenticated sender are displayed to users as "Domain Secured" in the Outlook and Outlook Web Access interface.
Domain Security uses Transport Layer Security (TLS) with mutual authentication to provide session-based authentication and encryption. TLS with mutual authentication differs from TLS as it is usually deployed. Typically, when TLS is deployed, it is used only to provide confidentiality in the form of encryption. No authentication occurs between the sender and receiver. In addition to this kind of deployment, sometimes when TLS is deployed, only the receiving server is authenticated. This deployment of TLS is typical of the HTTP implementation of TLS, which is Secure Sockets Layer (SSL).
With mutual TLS authentication, each server verifies the identity of the other server by validating a certificate that is provided by that other server. In this scenario, where messages are received from external domains over verified connections in an Exchange 2007 environment, Outlook 2007 will display a "Domain Secured" icon.
.gif) Important: |
|---|
|
It is beyond the scope of this white paper to provide a detailed explanation of cryptography and certificate technologies and concepts. Before you deploy any security solution that uses cryptography and digital certificates, we recommend that you understand the basic concepts of trust, authentication, encryption, and public and private key exchange as they relate to cryptography. For more information, see the references listed at the end of this white paper. Also, you can learn more about how Exchange 2007 uses certificates by reading Certificate Use in Exchange 2007 Server.
|
Objectives and acknowledgements Much of the information in this white paper originally appeared as individual Help topics in the Exchange Server 2007 Help. In this white paper, we have consolidated this information to provide an end-to-end, printable guide that you can use to deploy, test, and maintain Domain Security for Exchange 2007.
| Note: |
|---|
|
To print this white paper, click Printer Friendly Version in your Web browser.
|
This white paper is intended to walk you through the deployment of Domain Security. Read all of it. Also, as with any software deployment, we recommend that you set up the solution, by using self-signed certificates, in a lab and experiment with the functionality before you deploy it in the real world.
During the development of Exchange 2007, the Microsoft IT department deployed Domain Security with early adopter partners. As a result, configuration and deployment issues were discovered and fixed. Other minor configuration and deployment issues have also been identified and are documented in this white paper.
The following people were instrumental in deploying prerelease versions of Exchange 2007 and testing Domain Security functionality. Their experience and commitment to deploying this feature set resulted in invaluable information, much of which has been translated into the recommendations and best practices documented in this white paper: Victor Duchovni, Chris Henderson, Frank Hsieh, Robbie Roberts, Jonathan Ruckert, Andy Ryan, and Elmar Spreitzer.
The following people reviewed this content for technical accuracy: Chris Ahlers, Trevor Freeman, and Ross Smith IV.
Return to top