Microsoft Exchange Server Setup: DAG, TLS, Autodiscover Turnkey

Setting up a corporate mail server always begins with a surprise: Outlook won't connect, emails aren't delivered, Autodiscover doesn't work. In 80% of cases, the root cause lies in improper AD and DNS preparation. Exchange Server is a demanding product: it needs at least 128 GB RAM for production, correct split-brain DNS configuration, and a valid TLS certificate with names like autodiscover, mail, and owa. Violating any of these requirements leads to multi-day issues. We know this from 30+ projects. Contact us for a detailed assessment of your infrastructure.

Active Directory and DNS Preparation

Active Directory preparation is a critical step. Exchange extends the AD schema, adding hundreds of attributes and classes. This irreversible operation requires Schema Admin rights. Before running it, always perform a system state backup on each domain controller. The preparation process includes three commands executed sequentially.

# Prepare AD schema (run as Schema Admin)
.\Setup.exe /PrepareSchema /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF
# Prepare AD
.\Setup.exe /PrepareAD /OrganizationName:"CorpMail" /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF
# Prepare domain
.\Setup.exe /PrepareDomain /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF

After PrepareAD, you must wait for AD replication across all DCs. In a multi-site topology, this can take up to 8 hours. Launching Exchange installation before replication completes is a common mistake that leads to ActiveDirectoryObjectNotFoundException during installation.

DNS configuration: internal DNS must resolve mail.corp.ru, autodiscover.corp.ru, and the OWA name to the Exchange server's IP. External DNS must point to the public IP or WAF. Split-brain DNS is mandatory for Autodiscover to work correctly.

Why Autodiscover Is Exchange's Achilles' Heel

Autodiscover is the first thing Outlook and mobile devices check. If the DNS record is missing or the certificate does not cover autodiscover.*, the client won't connect automatically. In every project, we verify: the autodiscover.domain.com CNAME points to Exchange, and the SAN certificate includes that name. One wrong character—and email is unreachable. For example, on a recent project, misconfigured split-brain DNS caused Autodiscover failures for two days until we corrected the forward lookup zones.

How to Properly Install Exchange Server

# Install Windows prerequisites
Install-WindowsFeature -Name NET-Framework-45-Features, RPC-over-HTTP-proxy, `
    RSAT-Clustering, RSAT-Clustering-CmdInterface, RSAT-Clustering-Mgmt, `
    RSAT-Clustering-PowerShell, Web-Mgmt-Console, WAS-Process-Model, `
    Web-Asp-Net45, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, `
    Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, `
    Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, `
    Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, `
    Web-Net-Ext45, Web-Request-Monitor, Web-Server, Web-Stat-Compression, `
    Web-Static-Content, Web-Windows-Auth, Web-WMI, Windows-Identity-Foundation, `
    RSAT-ADDS -Restart
# Visual C++ Redistributable and Unified Communications Managed API 4.0 — manually from Microsoft website
# Then install Exchange
.\Setup.exe /Mode:Install /Role:Mailbox /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF

Configuring Connectors and Mail Flow

After installation, Exchange receives internal mail but does not send or receive external mail. Two connectors are needed.

# Receive Connector for inbound internet mail
New-ReceiveConnector -Name "Internet Inbound" `
    -Usage Internet `
    -Bindings "0.0.0.0:25" `
    -RemoteIPRanges "0.0.0.0/0" `
    -Server "EX01" `
    -AuthMechanism None `
    -PermissionGroups AnonymousUsers
Set-ReceiveConnector "EX01\Internet Inbound" `
    -PermissionGroups AnonymousUsers
Add-ADPermission -Identity "EX01\Internet Inbound" `
    -User "NT AUTHORITY\ANONYMOUS LOGON" `
    -ExtendedRights ms-Exch-SMTP-Accept-Any-Recipient
# Send Connector for outbound
New-SendConnector -Name "Internet Outbound" `
    -Usage Internet `
    -AddressSpaces "SMTP:*;1" `
    -DNSRoutingEnabled $true `
    -SourceTransportServers "EX01"

Why a Proper TLS Certificate Matters

Without a proper certificate, Outlook will not connect automatically, mobile clients will get trust errors, and SMTP sessions with other servers may degrade. A certificate from a public CA (e.g., Sectigo) costs from $120 per year for a single domain with SAN. In our projects, we always use certificates from public certificate authorities.

# Request certificate (if using internal CA)
$certRequest = New-ExchangeCertificate -GenerateRequest `
    -SubjectName "CN=mail.corp.ru" `
    -DomainName "mail.corp.ru","autodiscover.corp.ru","EX01","EX01.corp.local" `
    -PrivateKeyExportable $true `
    -RequestFile "C:\certreq.txt"
# After receiving the certificate — import and assign to services
Import-ExchangeCertificate -FileData ([Byte[]]$(Get-Content -Path "C:\cert.cer" -Encoding Byte -ReadCount 0))
# Assign to services
Enable-ExchangeCertificate -Thumbprint "ABCD1234..." -Services "SMTP,IIS,POP,IMAP"

Database Availability Group (DAG) for High Availability

A single Exchange server is a single point of failure. A DAG replicates mailbox databases between two or more servers. For more details, see the documentation on Database Availability Groups.

# Create DAG
New-DatabaseAvailabilityGroup -Name "DAG01" `
    -WitnessServer "dc01.corp.local" `
    -WitnessDirectory "C:\DAGWitness\DAG01" `
    -DatabaseAvailabilityGroupIPAddresses "10.10.1.60"

# Add members
Add-DatabaseAvailabilityGroupServer -Identity "DAG01" -MailboxServer "EX01"
Add-DatabaseAvailabilityGroupServer -Identity "DAG01" -MailboxServer "EX02"

# Add database copy to second server
Add-MailboxDatabaseCopy -Identity "Mailbox DB 01" `
    -MailboxServer "EX02" `
    -ActivationPreference 2

# Check replication status
Get-MailboxDatabaseCopyStatus * | Select Name, Status, CopyQueueLength, ReplayQueueLength

CopyQueueLength and ReplayQueueLength are key DAG health metrics. If the queue grows and does not drop—there is a network or I/O problem.

How DAG Improves Availability

DAG delivers 99.9% uptime compared to 99% for a single server. This reduces annual downtime from ~87 hours to ~8 hours. Combined with multiple CAS roles and load balancing, enterprise-level fault tolerance is achieved.

Monitoring and Maintenance

Exchange writes logs to C:\Program Files\Microsoft\Exchange Server\V15\Logging. The most useful for diagnostics: MessageTrackingLog (tracks the path of each email) and MailboxAuditLog. Queue Viewer (Get-Queue, Get-Message) displays queue status—if the submission queue grows, the Transport Service is not keeping up.

Our Work Process

1. Audit of AD, DNS, and existing mail infrastructure.
2. Topology planning (single server or DAG, connectors, routing).
3. Preparation of AD and servers.
4. Exchange installation.
5. Configuration of connectors, certificate, Autodiscover.
6. Mail flow testing.
7. If needed—migration from previous Exchange version or third-party systems.
8. Documentation.

What Is Included

• Audit of current AD, DNS, and network infrastructure.
• Architecture design (single server / DAG, quotas, policies).
• AD preparation and Exchange installation.
• Connector, TLS, and Autodiscover configuration.
• Mail flow and failover testing.
• Administrator training.
• Documentation (diagram, configurations, runbook).
• Post-release support for 2 weeks.

Over 7 years of Exchange implementation experience, 30+ successful projects. Our engineers are Microsoft certified.

The cost is calculated individually after an infrastructure audit. Get a consultation—we will assess your project and offer the optimal solution. Contact us via the form on the website or by phone.