Configure IIS SMTP Service to receive mail over TLS and forward to a non-TLS SMTP service on one Windows Server

Scenario

1. An older custom SMTP service only accepts unencrypted SMTP connections and does not support TLS.
2. A solution is required to receive emails over TLS using IIS SMTP Service and relay them to the custom SMTP service without encryption.
3. The goal must be achieved on a single virtual machine.

---

Environment Setup

Install two network interfaces on a single Windows Server with the following IP addresses:

• Network Interface 1: 10.11.11.11 (physical NIC)
• Network Interface 2: 10.22.22.22 (Description: Microsoft KM-TEST Loopback Adapter)

Fix: SMTP Service MMC has detected an error in a snap-in

When right-click on [SMTP Virtual Server #1] in IIS 6.0 Manager and SMTP Server, you may get this error:

"MMC has detected an error in a snap-in. It is recommended that you shut down and restart MMC."

Here's the fix:

1. Stop SMTPSVC service [Display Name: Simple Mail Transfer Protocol (SMTP)]
2. Stop IISADMIN service [Display name: IIS Admin Service]
3. Edit "C:\Windows\System32\inetsrv\MetaBase.xml"
4. Find: <IIsSmtpServer Location ="/LM/SmtpSvc/1"
5. Add (Settings are alphabetical): RelayIpList=""
6. Save file
7. Start IISAdmin Service
8. Start SMTPSVC service

Credit: https://serverfault.com/questions/1095395/how-do-i-resolve-the-snapin-error-when-setting-up-smtp-on-iis-server

以下提供 PowerShell 程式，直接執行完成上述步驟

Replace Ceritificate on IIS SMTP Virtual Server

$PFXPath = "C:\Cert\"

$PFXPW  = ''

$PublishedURL = "smtp.contoso.com"

Import-Module WebAdministration

$MicrosoftIISv2WMI = Get-CimInstance -Namespace root/MicrosoftIISv2 -Class __Namespace -ErrorAction SilentlyContinue

if ($MicrosoftIISv2WMI -eq $Null) {

Install-WindowsFeature Web-Mgmt-Compat, Web-WMI;

};

$SMTPServer = Get-CimInstance -Namespace root/MicrosoftIISv2 -Class IIsSmtpServerSetting -Filter ("FullyQualifiedDomainName='".$PublishedURL."'")

if ($SMTPServer.AccessSSL -ne $True) {

write-host 'TLS not enabled';

exit;

};