Setting up forced/mutual/required TLS with checktls.com, sending works, receiving returns 530 5.7.1 (not authenticated)

I have exchange 2010 on a 64-bit Windows Server 2008 R2 VM. I am using an SSL multi domain certificate from a certificate authority with IIS and SMTP services enabled. My goal is to setup assured/forced/mandatory/whatever-you-call-it TLS (not opportunistic) with the domain checktls.com. Before setting up any send/receive connectors with them I do their TestReceiver (http://checktls.com/perl/TestReceiver.pl) with all results ok and in the green.

• Connected to server
• We are allowed to connect
• we can use this server
• TLS is an option on this server
• STARTTLS command works on this server
• Connection converted to SSL
• (cert data)
• Cert VALIDATED: ok
• Cert Hostname VERIFIED
• TLS successfully started on this server
• Sender is OK
• Recipient OK, e-mail address proofed
• QUIT

Next I do their TestSender (http://checktls.com/perl/TestSender.pl) and the email comes back "SUCCESSFUL" with the confident text of "Your email was successfully sent securely using TLS."

Now for the connectors. In exchange, I create a new send connector named "CheckTLS" with the intended use of "Partner". Address space is "checktls.com" with "Include all subdomains" checked (Cost = 1). "Enable Domain Security (Mutual Auth TLS)" is checked.

I create a new receive connector named "CheckTLS" with the intended use of "Partner", port 25, and remote ip address of 69.61.187.232 (CheckTLS's ip address). "Transport Layer Security (TLS)" and "Enable Domain Security (Mutual Auth TLS)" are the only things checked on the Authentication tab. Permission groups has "Partners" and "Anonymous" checked.

I issue the powershell commands…

set-transportconfig -TLSReceiveDomainSecureList checktls.com

set-transportconfig -TLSSendDomainSecureList checktls.com

And here is where everything breaks…

CheckTLS's TestReceiver test has the following details…

• Connected to server
• We are allowed to connect
• we can use this server
• TLS is an option on this server
• STARTTLS command works on this server
• Connection converted to SSL
• (cert data)
• Cert VALIDATED: ok
• Cert Hostname VERIFIED
• TLS successfully started on this server
• Read failed (reason: timed out )
• Cannot proof e-mail address (reason: MAIL FROM rejected)
• Note:This does not affect the CheckTLS Confidence Factor
• QUIT
• 530 5.7.1 Not authenticated

My ReceiveSMTP logs on exchange look like this…

2014-09-17T18:57:43.290Z,MAIL\CheckTLS,08D1A0B838DEF207,0,10.10.30.9:25,69.61.187.232:56543,+,,
2014-09-17T18:57:43.290Z,MAIL\CheckTLS,08D1A0B838DEF207,1,10.10.30.9:25,69.61.187.232:56543,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions
2014-09-17T18:57:43.290Z,MAIL\CheckTLS,08D1A0B838DEF207,2,10.10.30.9:25,69.61.187.232:56543,>,"220 MAIL.EXAMPLE.COM Microsoft ESMTP MAIL Service ready at Wed, 17 Sep 2014 13:57:42 -0500",
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,3,10.10.30.9:25,69.61.187.232:56543,<,EHLO checktls.com,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,4,10.10.30.9:25,69.61.187.232:56543,>,250-MAIL.EXAMPLE.COM Hello [69.61.187.232],
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,5,10.10.30.9:25,69.61.187.232:56543,>,250-SIZE 10485760,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,6,10.10.30.9:25,69.61.187.232:56543,>,250-PIPELINING,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,7,10.10.30.9:25,69.61.187.232:56543,>,250-DSN,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,8,10.10.30.9:25,69.61.187.232:56543,>,250-ENHANCEDSTATUSCODES,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,9,10.10.30.9:25,69.61.187.232:56543,>,250-STARTTLS,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,10,10.10.30.9:25,69.61.187.232:56543,>,250-AUTH,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,11,10.10.30.9:25,69.61.187.232:56543,>,250-8BITMIME,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,12,10.10.30.9:25,69.61.187.232:56543,>,250-BINARYMIME,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,13,10.10.30.9:25,69.61.187.232:56543,>,250 CHUNKING,
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,14,10.10.30.9:25,69.61.187.232:56543,<,STARTTLS,
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,15,10.10.30.9:25,69.61.187.232:56543,>,220 2.0.0 SMTP server ready,
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,16,10.10.30.9:25,69.61.187.232:56543,*,,Sending certificate
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,17,10.10.30.9:25,69.61.187.232:56543,*,"CN=MAIL.EXAMPLE.COM, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated",Certificate subject
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,18,10.10.30.9:25,69.61.187.232:56543,*,"CN=PositiveSSL CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB",Certificate issuer name
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,19,10.10.30.9:25,69.61.187.232:56543,*,0011001001001001000100,Certificate serial number
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,20,10.10.30.9:25,69.61.187.232:56543,*,000011100011100001110001100,Certificate thumbprint
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,21,10.10.30.9:25,69.61.187.232:56543,*,MAIL.EXAMPLE.COM;AUTODISCOVER.EXAMPLE.COM;WEBMAIL.EXAMPLE.COM,Certificate alternate names
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,22,10.10.30.9:25,69.61.187.232:56543,<,EHLO checktls.com,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,23,10.10.30.9:25,69.61.187.232:56543,*,,TlsDomainCapabilities='None'; Status='NoRemoteCertificate'
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,24,10.10.30.9:25,69.61.187.232:56543,>,250-MAIL.EXAMPLE.COM Hello [69.61.187.232],
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,25,10.10.30.9:25,69.61.187.232:56543,>,250-SIZE 10485760,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,26,10.10.30.9:25,69.61.187.232:56543,>,250-PIPELINING,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,27,10.10.30.9:25,69.61.187.232:56543,>,250-DSN,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,28,10.10.30.9:25,69.61.187.232:56543,>,250-ENHANCEDSTATUSCODES,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,29,10.10.30.9:25,69.61.187.232:56543,>,250-AUTH,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,30,10.10.30.9:25,69.61.187.232:56543,>,250-8BITMIME,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,31,10.10.30.9:25,69.61.187.232:56543,>,250-BINARYMIME,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,32,10.10.30.9:25,69.61.187.232:56543,>,250 CHUNKING,
2014-09-17T18:57:43.945Z,MAIL\CheckTLS,08D1A0B838DEF207,33,10.10.30.9:25,69.61.187.232:56543,<,MAIL FROM:<test@checktls.com>,
2014-09-17T18:57:43.945Z,MAIL\CheckTLS,08D1A0B838DEF207,34,10.10.30.9:25,69.61.187.232:56543,*,Tarpit for '0.00:00:30',
2014-09-17T18:58:13.959Z,MAIL\CheckTLS,08D1A0B838DEF207,35,10.10.30.9:25,69.61.187.232:56543,>,530 5.7.1 Not authenticated,
2014-09-17T18:58:13.959Z,MAIL\CheckTLS,08D1A0B838DEF207,36,10.10.30.9:25,69.61.187.232:56543,<,QUIT,
2014-09-17T18:58:13.959Z,MAIL\CheckTLS,08D1A0B838DEF207,37,10.10.30.9:25,69.61.187.232:56543,>,221 2.0.0 Service closing transmission channel,
2014-09-17T18:58:13.959Z,MAIL\CheckTLS,08D1A0B838DEF207,38,10.10.30.9:25,69.61.187.232:56543,-,,Local

Because I now cannot receive anything from CheckTLS, I cannot see the results of their CheckSender test, but my exchange server's SendSMTP logs show the following…

2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,10,10.10.30.9:63267,69.61.187.246:25,<,220 Ready to start TLS,
2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,11,10.10.30.9:63267,69.61.187.246:25,*,,Sending certificate
2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,12,10.10.30.9:63267,69.61.187.246:25,*,"CN=mail.EXAMPLE.COM, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated",Certificate subject
2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,13,10.10.30.9:63267,69.61.187.246:25,*,"CN=PositiveSSL CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB",Certificate issuer name
2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,14,10.10.30.9:63267,69.61.187.246:25,*,1110010101010101010101001111,Certificate serial number
2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,15,10.10.30.9:63267,69.61.187.246:25,*,1100101001001010010101001010101010101,Certificate thumbprint
2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,16,10.10.30.9:63267,69.61.187.246:25,*,MAIL.EXAMPLE.COM;AUTODISCOVER.EXAMPLE.COM;WEBMAIL.EXAMPLE.COM,Certificate alternate names
2014-09-17T19:13:00.194Z,CheckTLS,08D1A0B838DEF26D,17,10.10.30.9:63267,69.61.187.246:25,*,,Received certificate
2014-09-17T19:13:00.194Z,CheckTLS,08D1A0B838DEF26D,18,10.10.30.9:63267,69.61.187.246:25,*,11010010010010101010010101001001001,Certificate thumbprint
2014-09-17T19:13:00.194Z,CheckTLS,08D1A0B838DEF26D,19,10.10.30.9:63267,69.61.187.246:25,>,EHLO MAIL.EXAMPLE.COM,
2014-09-17T19:13:00.241Z,CheckTLS,08D1A0B838DEF26D,20,10.10.30.9:63267,69.61.187.246:25,<,"250-ts3.checktls.com Hello mail.EXAMPLE.COM [1.2.3.4], pleased to meet you",
2014-09-17T19:13:00.241Z,CheckTLS,08D1A0B838DEF26D,21,10.10.30.9:63267,69.61.187.246:25,<,250-ENHANCEDSTATUSCODES,
2014-09-17T19:13:00.241Z,CheckTLS,08D1A0B838DEF26D,22,10.10.30.9:63267,69.61.187.246:25,<,250-8BITMIME,
2014-09-17T19:13:00.241Z,CheckTLS,08D1A0B838DEF26D,23,10.10.30.9:63267,69.61.187.246:25,<,250 HELP,
2014-09-17T19:13:00.241Z,CheckTLS,08D1A0B838DEF26D,24,10.10.30.9:63267,69.61.187.246:25,*,2238593,sending message
2014-09-17T19:13:00.241Z,CheckTLS,08D1A0B838DEF26D,25,10.10.30.9:63267,69.61.187.246:25,>,MAIL FROM:<ME@EXAMPLE.COM>,
2014-09-17T19:13:00.288Z,CheckTLS,08D1A0B838DEF26D,26,10.10.30.9:63267,69.61.187.246:25,<,250 Ok - mail from ME@EXAMPLE.COM,
2014-09-17T19:13:00.288Z,CheckTLS,08D1A0B838DEF26D,27,10.10.30.9:63267,69.61.187.246:25,>,RCPT TO:<test@TestSender.CheckTLS.com>,
2014-09-17T19:13:00.350Z,CheckTLS,08D1A0B838DEF26D,28,10.10.30.9:63267,69.61.187.246:25,<,250 Ok - recipient test@TestSender.CheckTLS.com,
2014-09-17T19:13:00.350Z,CheckTLS,08D1A0B838DEF26D,29,10.10.30.9:63267,69.61.187.246:25,>,DATA,
2014-09-17T19:13:00.397Z,CheckTLS,08D1A0B838DEF26D,30,10.10.30.9:63267,69.61.187.246:25,<,354 Send data.  End with CRLF.CRLF,
2014-09-17T19:13:00.537Z,CheckTLS,08D1A0B838DEF26D,31,10.10.30.9:63267,69.61.187.246:25,<,250 Ok,
2014-09-17T19:13:00.553Z,CheckTLS,08D1A0B838DEF26D,32,10.10.30.9:63267,69.61.187.246:25,>,QUIT,
2014-09-17T19:13:00.600Z,CheckTLS,08D1A0B838DEF26D,33,10.10.30.9:63267,69.61.187.246:25,<,221 ts3.checktls.com closing connection,
2014-09-17T19:13:00.600Z,CheckTLS,08D1A0B838DEF26D,34,10.10.30.9:63267,69.61.187.246:25,-,,Local

The Event viewer in exchange shows an event id 11017 (MSExchangeTransport) with the message "A message from domain-secured domain 'CheckTLS.com' on connector 'CheckTLS' failed to authenticate because no Transport Layer Security (TLS) certificate was supplied. Contact the administrator for CheckTLS.com to resolve the problem, or remove the domain from the domain-secured list."

I have a Sonicwall NSA 2400 firewall, as I have read some TLS issues with Cisco firewalls doing something with TLS traffic. Nothing I have seen in the Sonicwall logs would indicate this is the issue.

Sorry for the bombardment of information, but I'm at my wits end trying to get this setup properly. Any recommendations on where I can go next would be appreciated. Once I get it working properly with CheckTLS, the plan is to set it up with actual business partners, but first I need all my ducks in a row.

Thank you kindly.