Autodiscover is essential for providing external access to you Exchange multi-tenant users. What I would like to cover is how to properly deploy autodiscover for Exchange 2010 Multi-Tenant /hosting deployments. To get
a better understanding of autodiscover you can read White Paper: Exchange 2007 Autodiscover Service.
The mechanisms between Exchange 2007 and Exchange 2010 are the same so the article will apply here. Below is a chart from that article that provides you with four different scenarios to configure Autodiscover for an Exchange Environment.
Scenario 1: Using a certificate that supports multiple DNS names
Scenario 2: Using one single-name certificate
Scenario 3: Using two single-name certificates
Scenario 4: Using the Autodiscover service with redirection
As you can see there are multiple scenarios for connecting to the autodiscover service from the internet. So what I want to do explain how to deploy autodiscover for an Exchange Multi-tenant /hosting environment. In essence there are 2 ways to publish autodiscover
for the hosted email tenants.
Autodiscover SRV Record
In this scenario you will use a single-name on the certificate and will only be implementing SRV records for autodiscover. You will only require 1 public ip address since the SRV record will point to the FQDN name on that certificate.
With this solution the Outlook 2007/2010 client will use the SRV record when trying to resolve the autodiscover record for that users smtp address. That client will directly connect to you Exchange CAS server’s public ip address. Your Tenant administrator will
have to create a SRV record with the DNS service provider handling the tenant’s public DNS records.
For more information on configuring a SRV record go to the following link:
Note In this example, mail.contoso.com is a name for which your certificate is valid. Usually, this is the same DNS name that you use for Outlook Anywhere and for Outlook Web Access.
In this example, the Autodiscover service does the following when the client tries to contact the Autodiscover service:
1. Autodiscover posts to https://testorg1.org/Autodiscover/Autodiscover.xml. This fails.
2. Autodiscover posts to https://autodiscover.testorg1.org/Autodiscover/Autodiscover.xml. This fails.
3. Autodiscover posts to http://autodiscover.testorg1.org/Autodiscover/Autodiscover.xml This fails.
4. Autodiscover performs the following redirect check using the looking for SRV record:
5. Autodiscover uses DNS SRV lookup for _autodiscover._tcp.testorg1.com, and then "mail.contoso.com" is returned.
6. Outlook asks permission from the user to continue with Autodiscover to post to
7. Autodiscover's POST request is successfully posted to https://mail.contoso.com/autodiscover/autodiscover.xml.
Here is an Example of a Test-E-mail AutoConfiguration connection
Note: Not all DNS service providers have the ability to create SRV records. If the DNS provider being used is unable to create a SRV records then the autodiscover redirection
method can be used.
Autodiscover redirection method
This method permits your tenant users to connect to your Exchange using the same SSL certificate despite the domain that your tenants use. For the autodiscover feature to work with hosted e-email domains you must redirect the request to the matching name on
the SSL certificate on the Exchange. The preferred method is to use create a redirect website as per the following Technet article. This will require a dedicated ip address for the autodiscover redirect and a second ip address for your Exchange server.