# Session Log: 2026-03-17 - Neptune Exchange Server Cleanup & Mailprotector Configuration

## Session Summary

Comprehensive Exchange Server maintenance on Neptune (mail.acghosting.com / 67.206.163.124). Cleaned up stale accepted domains and mailboxes, fixed outbound mail routing through Mailprotector (emailservice.io) smarthosts, created inbound restriction rules, tightened DNS security records, and purged ~20K spam messages that bypassed the filter.

### Key Accomplishments

1. **Accepted Domain Cleanup** - Removed 9 stale domains, disabled 23 mailboxes total (12 on removed domains, 11 orphans, 1 leftover)
2. **Send Connector Fix** - Moved all send connectors from dead MAIL server to NEPTUNE
3. **SBR Routing Restored** - Added devconllc.com and littlehearts domains to Mailprotector SBR agent config
4. **Transport Rule for Inbound Restriction** - Created rule blocking direct delivery (bypassing Mailprotector) for devcon and littlehearts domains
5. **DNS Hardening** - Added secondary MX records and tightened DMARC to p=reject for devconllc.com
6. **Spam Purge** - Soft-deleted 20,473 spam messages from littlehearts/airandspace mailboxes that bypassed filter

### Key Decisions
- MAIL server no longer exists - all routing moved to NEPTUNE
- airandspaceacademy.com is the old domain name for littleheartslittlehands (school renamed)
- simplehost.email kept as default accepted domain (was originally slated for removal)
- littleheartslittlehands.com and acg.local kept as safe domains
- Transport rules using RouteMessageOutboundConnector are NOT supported on-prem Exchange 2016 (Multi-tenant only error)
- SBR routing uses two transport agents: messageconcept ExSBR + Microsoft Exchange SBR with config files in agents\Custom folder

### Problems Encountered
1. **Transport rules crashed transport service** - RouteMessageOutboundConnector action throws "Multi-tenant deployments supported only" on standalone Exchange 2016. All messages got poisoned. Fixed by removing rules and using SBR agent config instead.
2. **Pickup/Replay directory messages poisoned** - Test messages injected via pickup/replay directories were marked as poison. Used real mailbox send for testing instead.
3. **Search-Mailbox can't move within same mailbox** - "source mailbox cannot be used as the target mailbox." Used -DeleteContent (soft delete to Recoverable Items) instead.

---

## Infrastructure Details

### Exchange Servers
- **NEPTUNE** (primary, this server): Exchange 2016 Standard Evaluation, Build 15.1.2507.17
- **MAIL**: Exchange 2016 Enterprise, Build 15.1.2507.18 - **NO LONGER EXISTS**
- Both registered as Mailbox role servers

### Server Details
- **Hostname:** neptune.acghosting.com / mail.acghosting.com
- **External IP:** 67.206.163.124
- **Internal IP:** 172.16.3.11
- **Domain:** acg.local
- **Let's Encrypt Cert:** CN=mail.acghosting.com, SANs: autodiscover.acghosting.com, autodiscover.amtransit.com, mail.amtransit.com, mail.devconllc.com, mail.littleheartslittlehands.org, mail.packetdial.com, mail.rieussetcorp.com, mail.tucsongoldencorral.com
- **Cert Expiry:** 2026-05-31

### DKIM Signer
- **Agent:** Exchange DkimSigner (C:\Program Files\Exchange DkimSigner\ExchangeDkimSigner.dll)
- **Algorithm:** RSA-SHA256, Simple/Simple canonicalization
- **Configured Domains:**
  - amtransit.com (selector: s1)
  - littleheartslittlehands.org (selector: default)
  - tucsongoldencorral.com (selector: dkim)
  - devconllc.com (selector: default)
  - jparkinsonaz.com (selector: s1)
  - rieussetcorp.com (selector: s1)
- **Keys:** C:\Program Files\Exchange DkimSigner\keys\

### SBR Agent Configuration
- **Config Path:** C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\agents\Custom\
- **Files:**
  - `Microsoft.Exchange.SBR.dll` - SBR routing agent
  - `Microsoft.Exchange.SBR.InternalDomains.config` - Domain list
  - `Microsoft.Exchange.SBR.OverrideSettings.config` - Domain-to-SBR mapping
  - `Microsoft.Exchange.SBR.IgnoreAuthAs.config` - (empty)
- **Also installed:** messageconcept ExSBR (C:\Program Files\messageconcept\ExSBR\SenderBasedRouting.dll)

### SBR Config (OverrideSettings.config) - Current State
```
amtransit.com;amtransit.sbr
littleheartslittlehands.org;littleheartslittlehands.sbr
tucsonsafety.com;tucsonsafety.sbr
rieussetcorp.com;rieussetcorp.sbr
devconllc.com;devconllc.sbr
littleheartslittlehands.com;littleheartslittlehands.sbr
airandspaceacademy.com;airandspaceacademy.sbr
```

### SBR Config (InternalDomains.config) - Current State
```
amtransit.com
littleheartslittlehands.org
tucsonsafety.com
rieussetcorp.com
devconllc.com
littleheartslittlehands.com
airandspaceacademy.com
```

---

## Mailprotector (emailservice.io) IPs

### Transport Servers (US)
- 52.0.70.91
- 52.0.74.211
- 52.0.31.31

### Inbound Gateway Servers
- 52.0.43.153, 52.0.90.6, 52.0.156.43, 52.0.161.190
- 52.1.76.196, 52.1.130.188, 52.1.217.73
- 54.85.114.151, 54.152.152.44, 54.80.77.105
- 52.204.186.160, 3.213.159.102, 23.20.39.50
- 18.214.219.227, 34.233.23.45

### LDAP/AD Sync
- 54.152.160.142, 54.152.160.187

### Europe Transport
- 54.229.38.56, 54.229.197.37, 54.229.198.191

### Asia Pacific Transport
- 54.66.143.79, 54.66.158.252, 54.66.239.122

---

## Changes Made

### 1. Accepted Domains Removed (9)
botapro.com, capacitance.rocks, cycloneinspiredproducts.com, gurushow.com, heieck.org, rondieyancey.com, royalweedcontrol.com, sstargroup.com, thisisnotmy.email

### 2. Mailboxes Disabled (24 total)
**On removed domains (12):** kurt/brit/christine/mailer/orders/payments@botapro.com, info@cycloneinspiredproducts.com (acg.local primary), sheila/jjh@heieck.org, sales/admin@royalweedcontrol.com, crf@sstargroup.com

**Orphan domains (11):** rondie@lamaddux.com, social@erinhelm.com, 8231/skeener/skeener2/y226/bt/walid@tedards.net, info@retiredpaws.org, info/katta@emoxpress.com

**Leftover (1):** cyclone@acg.local

### 3. Remaining Accepted Domains (19)
acg.local, acghosting.com (ExternalRelay), airandspaceacademy.com, amtransit.com, devconllc.com, farwestwell.com, goldenchoicecatering.com, jparkinsonaz.com, justsimplysmart.com, lifelonglearningacademy.com, littleheartslittlehands.com, littleheartslittlehands.org, outaboundssports.com, packetdial.com, patriotinternalmedicine.com, rieussetcorp.com, simplehost.email (Default), tucsongoldencorral.com, tucsonsafety.com

### 4. Send Connectors (Final State)
All sourced from NEPTUNE:

| Connector | Address Space | Smart Host |
|-----------|--------------|------------|
| Outbound.DEVCON | devconllc.sbr | devconllc-com.outbound.emailservice.io |
| Outbound.LittleHearts | littleheartslittlehands.sbr, airandspaceacademy.sbr | littleheartslittlehands-org.outbound.emailservice.io |
| Outbound.Patriot | patriotinternalmedicine.sbr | patriotinternalmedicine-com.outbound.emailservice.io |
| Outbound.Farwestwell | farwestwell.sbr | farwestwell-com.outbound.emailservice.io |
| Outbound.TGC | tucsongoldencorral.sbr | tucsongoldencorral-com.outbound.emailservice.io |
| Outbound.LLA | lifelonglearningacademy.sbr | lifelonglearningacademy-com.outbound.emailservice.io |
| Outbound.AMT | amtransit.sbr | amtransit-com.outbound.emailservice.io |
| Outbound.TucsonSafety | tucsonsafety.sbr | tucsonsafety-com.outbound.emailservice.io |
| Outbound.Sorensen | rieussetcorp.sbr | rieussetcorp-com.outbound.emailservice.io |
| Horseshoe Outbound | horseshoemgt.sbr | horseshoemgt-com.outbound.emailservice.io |
| Outbound.Avoid Filter | Q.com | webhost.acghosting.com |
| Other | * (catch-all) | DNS routing |

**Removed:** devconllc.com_ExSBR (duplicate), AOL/YAHOO (disabled)

### 5. Transport Rules (Final State)
| Rule | Priority | Description |
|------|----------|-------------|
| Restrict Inbound - Devcon and LittleHearts | 0 | Reject 5.7.1 if recipient is devconllc.com/littleheartslittlehands.org/.com/airandspaceacademy.com AND sender is external AND source IP not in Mailprotector list |
| Webhost Spam | 1 | Delete messages from webhost.acghosting.com or fabry |
| Bardach BCC | 2 | BCC rule for Bardach |

### 6. DNS Changes (devconllc.com via IX WHM API)
- **Added:** MX 20 devconllc-com.inbound.emailservice.cc
- **Added:** MX 30 devconllc-com.inbound.emailservice.co
- **Updated:** DMARC from `p=none;sp=none` to `p=reject;sp=reject;fo=1`

### 7. Spam Purge Results
20,473 messages soft-deleted (Recoverable Items, 14 days retention):
- rklem@littleheartslittlehands.org: 7,798
- marylou@littleheartslittlehands.org: 12,594
- sbranch@airandspaceacademy.com: 5
- ajoseph@airandspaceacademy.com: 35
- mrocha@airandspaceacademy.com: 33
- tstevens@airandspaceacademy.com: 4
- email@airandspaceacademy.com: 4

---

## Credentials Used

### IX Server (WHM API)
- **Host:** ix.azcomputerguru.com:2087
- **User:** root
- **Password:** Gptf*77ttb!@#!@#
- **API:** JSON API via curl with basic auth
- **Used for:** DNS zone queries and edits (dumpzone, addzonerecord, editzonerecord)

### Neptune Exchange
- **Access:** Local PowerShell with Exchange Management Shell snapin
- **Snapin:** Microsoft.Exchange.Management.PowerShell.SnapIn
- **No credentials needed** (running as administrator.ACG)

---

## Domain Status Summary

### devconllc.com - FULLY CONFIGURED
- DNS: IX (ns1/ns2.acghosting.com)
- MX: 3x Mailprotector inbound [OK]
- SPF: Includes spf.us.emailservice.io [OK]
- DKIM: default selector, signing on Exchange [OK]
- DMARC: p=reject [OK]
- Outbound: SBR -> devconllc-com.outbound.emailservice.io [OK]
- Inbound restriction: Transport rule [OK]

### littleheartslittlehands.org - FULLY CONFIGURED
- DNS: IX (ns1/ns2.acghosting.com)
- MX: 3x Mailprotector inbound [OK]
- SPF: Includes spf.us.emailservice.io [OK]
- DKIM: default selector, signing on Exchange [OK]
- DMARC: p=none (could tighten)
- Outbound: SBR -> littleheartslittlehands-org.outbound.emailservice.io [OK]
- Inbound restriction: Transport rule [OK]

### airandspaceacademy.com - NEEDS DNS FIX
- DNS: GoDaddy (ns71/ns72.domaincontrol.com)
- MX: **STILL POINTS TO mail.acghosting.com (DIRECT - NO FILTER)**
- Outbound: SBR -> airandspaceacademy.sbr connector [OK]
- Inbound restriction: Transport rule now BLOCKING direct delivery
- **ACTION NEEDED:** Change MX on GoDaddy to airandspaceacademy-com.inbound.emailservice.io (if provisioned in Mailprotector)

### littleheartslittlehands.com - PARTIAL
- DNS: Cloudflare (kristina/nile.ns.cloudflare.com)
- MX: Points to cbsolt.net (NOT Mailprotector)
- Outbound: SBR configured [OK]
- **ACTION NEEDED:** Change MX on Cloudflare to Mailprotector

---

## Pending/Incomplete Tasks

1. **airandspaceacademy.com MX** - Needs changing from mail.acghosting.com to Mailprotector inbound on GoDaddy DNS. Currently being REJECTED by the new transport rule.
2. **littleheartslittlehands.com MX** - Points to cbsolt.net on Cloudflare, needs updating to Mailprotector.
3. **littleheartslittlehands.org DMARC** - Currently p=none, should be tightened to p=reject like devcon.
4. **Missing SBR domains** - farwestwell, patriotinternalmedicine, tucsongoldencorral, goldenchoicecatering, lifelonglearningacademy not in SBR config files yet (they have send connectors but SBR agent won't route them).
5. **Transport cert expiring** - Thumbprint 5C202EE2700E34A121642FDA07190ABE907D6EAD expires 2026-05-31.
6. **Retry queues** - ~40 empty retry queues from flushed spam still visible (will auto-clean).
7. **MAIL server removal from AD/Exchange** - Dead server still registered. Should be formally decommissioned.
8. **Horseshoe Management** - Has SBR send connector but domain not in SBR config and no accepted domain. Status unknown.
9. **5 outdated WordPress sites on IX** - Security risk (from previous IX cleanup session).

---

## Reference

### Exchange PowerShell Quick Reference
```powershell
# Load snapin
Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn

# SBR config files
C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\agents\Custom\Microsoft.Exchange.SBR.OverrideSettings.config
C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\agents\Custom\Microsoft.Exchange.SBR.InternalDomains.config

# DKIM config
C:\Program Files\Exchange DkimSigner\settings.xml
C:\Program Files\Exchange DkimSigner\keys\

# Frontend protocol logs (contains real source IPs)
C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive\

# Restart transport after SBR config changes
Restart-Service MSExchangeTransport -Force
```

### WHM API (IX Server)
```bash
# Dump zone
curl -sk "https://ix.azcomputerguru.com:2087/json-api/dumpzone?domain=DOMAIN" -u "root:PASSWORD"

# Add record
curl -sk "https://ix.azcomputerguru.com:2087/json-api/addzonerecord?domain=DOMAIN&type=TYPE&..." -u "root:PASSWORD"

# Edit record (need Line number from dumpzone)
curl -sk "https://ix.azcomputerguru.com:2087/json-api/editzonerecord?domain=DOMAIN&Line=N&..." -u "root:PASSWORD"

# Find cPanel user for domain
curl -sk "https://ix.azcomputerguru.com:2087/json-api/listaccts?searchtype=domain&search=DOMAIN" -u "root:PASSWORD"
```
