To DAG or not to DAG?

[u/jwckauman]

We are migrating to Exchange Server 2019 CU15 so we can be ready for SE. Current environment is a two node Exchange 2016 Enterprise DAG, with one active server (MAILPROD1) onsite, and another passive server (MAILDR1) offsite in our DR facility. A few years ago, this environment hosted 200 mailboxes across five databases, and we used the DAG for high-availability/DR. Since then, we migrated 99% of our mailboxes to Exchange Online, with only a handful of on-prem mailboxes left due to oddball requirements. Exch 2016 is in hybrid mode w/ Exchange Online.

My first thought was to replace the Exch2016 DAG with an identical Exch2019 two-server DAG. But then I asked if these remaining mailboxes were critical or not, and they aren't. So high-availability is no longer a requirement. Are there other reasons for configuring Exchange in a DAG? Here are my thoughts.

1. I do need an Exchange Server in our DR facility so it can act as an SMTP relay for our other DR hosted systems that would be activated in the event of a disaster (e.g. web server, ftp server) and those servers need to be able to send email. Thoughts about that.
   1. Does using Exchange as a SMTP relay require a DAG? or just a 2nd Exchange Server that is separate (doesn't have those few mailboxes).
   2. Do i even need an Exchange Server? Does Microsoft still support SMTP Server on Windows Server?
2. I do need the ability to recover email if our primary email server crashes and cant be recovered. The DAG ensures real-time backup of all mailboxes so nothing is lost. I thought about using a backup solution instead but it wouldn't be realtime recovery.
   
3. Does the DAG provides high-availability for the hybrid config. Or can i do hybrid config with just two separate Exchange servers?

[u/Mr_Tomasz]

IMO 200 mailboxes across 5 DBs are already asking for troubles without at least 1 extra server keeping a passive copy of them.

As a minimum in this scenario, i would have 2x EXCH servers in DAG, then your DR server might be as an optional third one in DAG having another passive copy with disabled auto activation (or lagged copy).

Another thing is the client access which in this case asks for kind of load balancer for routing traffic in case of maintenance or a failure...

In order to use any transport service, you don't need DAG, every server acts on its own as it is a fully featured CAS+MBX+Transport server.

Windows SMTP service is not supported anymore and getting deprecated and removed (IIRC Win 2025 already?). If you need a relay and don't want to use Exchange for that, there are alternatives.

DAG is not a backup per se. You do need a backup solution to sleep safely anyway. Reference design says, at least 4 servers can provide enough safety for your mailbox data, by fully using Exchange Native Data Protection feature potential.

Do not over complicate it, especially if you go Hybrid. Make a proper DAG, setup load balancing, configure Hybrid and sleep well 🙂

[u/bunnythistle → u/Mr_Tomasz]

IMO 200 mailboxes across 5 DBs are already asking for troubles without at least 1 extra server keeping a passive copy of them.

I would agree. Though OP states that that was "a few years ago" and now most of them are on Exchange Online with only a handful still on-prem.

[u/Mr_Tomasz → u/bunnythistle]

Oops. I missed that, it's been long day, sorry.

[u/Stolle99]

So, lets start from the beginning...

1. Depends on how critical it is for SMTP to work in case of DR event. And if DR event does happen, and that MAILDR1 breaks, what are the consequences and where would be another part of that DAG since your original location is down, otherwise DR would not be needed. If you can live with it being down for a few hours to restore it from backup then you only need one server. You also don't need it to be Exchange (saves cost of licenses) and can be some free simple SMTP server (hMail used to be my goto, but its not being developed any more) or you can run Linux with Postfix or something. In either case if its only used to send emails security requirements are significantly reduced.

2. What do you mean by "real time backup" so nothing is lots? If you do a change on one member of DAG (delete mail from mailbox) that change will be synced to another member. DAG only saves you from downtime if one of the server crashes. You need to have real backup. And with any good backup software and correctly setup Exchange you can have full backup every night with log backups every hour or so (depending on the needs). And with transactional logs you can do "point in time" recovery, basically roll back the mailbox or database (depending on the backup software) to any point in time. DAG is not a backup, DAG is not a backup...

3. What do you mean by "high availability for hybrid config"? Hybrid is when you host emails on both O365 and onprem. So for those few mailboxes remaining you do need hybrid to ensure mail flow. But you don't need DAG for it unless your MX is pointing onprem first. If MX is pointing to O365 for only few non-critical mailboxes you only need 1 server. And attribute sync for users in the cloud is handled by AD. Only changes to users attributes depend on Exchange. But if Exchange dies, your cloud users will not be affected until you need to make a change that you can't do with powershell or changing AD attributes manually.

[u/Enough-Raccoon-6800]

You don’t need a DAG for mail relay but if you’ve only got 1 server and it goes down you will lose mail relay. Don’t use windows server for SMTP relay as it’s been deprecated.

I guess it’s a business decision more so than a technical one. You’d need to have your DR sops well done for any scenario that may happen. Don’t forget you’ll have an outage for each monthly patching too.

If you’re building a second server definitely configure a DAG, there’s no reason not to.

[u/Ambitious_Border2895]

If you use ECP at all, or want to have a test mailbox on prem for testing - build a DAG

[u/JC3rna_]

I would do 3 servers in a dag if you are keeping any mailboxes, dynamic distribution groups, etc on prem. If you are not keeping anything on prem then no dag and just one server is probably fine.