Autodiscover Check

Autodiscover is the way Outlook finds the responsible Exchange server and all its endpoints for an email address, without the user typing server names. If Autodiscover fails, an Exchange mailbox cannot be set up in Outlook, or only with certificate warnings. This check inspects the three building blocks Outlook accesses in turn: DNS, TLS certificate and the Autodiscover response itself.

What this tool checks

DNS: the entries autodiscover.<domain> (A/CNAME) and _autodiscover._tcp.<domain> (SRV), plus the MX hint. Endpoint: from that, exactly one HTTPS target on port 443 is chosen (the autodiscover host, otherwise the SRV target, otherwise the domain itself) and tested. At the endpoint the TLS certificate is checked (chain, validity and whether it lists the Autodiscover host name as a SAN, which Outlook strictly requires) and an AutodiscoverV1 call with NTLM Type 1 is made. A healthy Exchange responds with 401 and the offered authentication methods in the WWW-Authenticate header. Microsoft 365 is detected (CNAME to autodiscover.outlook.com or MX to mail.protection.outlook.com) and reported only as a note, without a connection test.

Reading the result

Green means: an Autodiscover target found in DNS, a certificate that covers the name, and a 401 response with sensible auth methods. A 401 is the desired result here: the endpoint should require a login. Reported as a hardening finding are offered NTLM/Negotiate (internal names in the Type 2 token), an old Windows build number and an outdated Exchange build from the X-OWA-Version header. A name not covered or an expired certificate is an error, as is a dedicated endpoint that does not behave like Exchange at all.

Background

Autodiscover is a Microsoft protocol ([MS-OXDSCLI]), not an RFC standard. The SRV entry _autodiscover._tcp follows the general SRV format from RFC 2782. The rule that a certificate must list the addressed host name as a Subject Alternative Name comes from RFC 6125. This test sends only the first negotiation step and never credentials; AutodiscoverV2 and any further endpoints are deliberately not checked.

Common problems and how to fix them

• No Autodiscover entry in DNS. Create an autodiscover.<domain> record (A or CNAME to the Exchange name), alternatively an SRV record _autodiscover._tcp with a target and port 443. Without it, Outlook only guesses and often ends up at the wrong address.
• Outlook shows a certificate warning. Almost always the certificate does not cover autodiscover.<domain>. Use a certificate that lists all names as SANs (autodiscover., mail., owa.), or set the Autodiscover response so it points to a covered name.
• Endpoint returns 200 without a login. The AutodiscoverV1 path is then anonymously reachable and may reveal internal settings. Enable pre-authentication at the reverse proxy or Windows authentication in IIS.
• Outdated Exchange build. The build derived from X-OWA-Version is behind the current Cumulative Update. Install the current CU plus the latest security update; older builds usually contain known vulnerabilities.
• SRV record present but ignored. Outlook only uses SRV if autodiscover.<domain> does not resolve directly. The target of the SRV record must also be reachable over HTTPS with a valid certificate.

More background in the blog article Exchange 2016: a comprehensive whitepaper on Autodiscover on frankysweb.de (in German).